GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-26856 (GCVE-0-2025-26856)

Vulnerability from cvelistv5 – Published: 2025-02-20 05:49 – Updated: 2025-02-20 16:15
VLAI
Summary
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. If an attacker logs in to the affected product with an administrative account and manipulates requests for a certain screen operation, an arbitrary OS command may be executed. This vulnerability was reported on a different screen operation from CVE-2025-20617.
Severity
7.2 (High)
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-20 16:15 UTC
CWE
  • CWE-78 - Improper neutralization of special elements used in an OS command ('OS Command Injection')
Assigner
References
Impacted products
Vendor Product Version CPE status
I-O DATA DEVICE, INC. UD-LT2 Affected: firmware Ver.1.00.008_SE and earlier
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-26856",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-20T16:15:09.554134Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-20T16:15:20.874Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "UD-LT2",
          "vendor": "I-O DATA DEVICE, INC.",
          "versions": [
            {
              "status": "affected",
              "version": "firmware Ver.1.00.008_SE and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper neutralization of special elements used in an OS command (\u0027OS Command Injection\u0027) issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. If an attacker logs in to the affected product with an administrative account and manipulates requests for a certain screen operation, an arbitrary OS command may be executed. This vulnerability was reported on a different screen operation from CVE-2025-20617."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper neutralization of special elements used in an OS command (\u0027OS Command Injection\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-20T05:49:49.402Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.iodata.jp/support/information/2025/01_ud-lt2/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN15293958/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-26856",
    "datePublished": "2025-02-20T05:49:49.402Z",
    "dateReserved": "2025-02-17T00:29:49.508Z",
    "dateUpdated": "2025-02-20T16:15:20.874Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-26856",
      "date": "2026-09-16",
      "epss": "0.01122",
      "percentile": "0.64566"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-26856\",\"sourceIdentifier\":\"vultures@jpcert.or.jp\",\"published\":\"2025-02-20T06:15:21.673\",\"lastModified\":\"2026-06-17T09:02:29.693\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper neutralization of special elements used in an OS command (\u0027OS Command Injection\u0027) issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. If an attacker logs in to the affected product with an administrative account and manipulates requests for a certain screen operation, an arbitrary OS command may be executed. This vulnerability was reported on a different screen operation from CVE-2025-20617.\"},{\"lang\":\"es\",\"value\":\"La neutralizaci\u00f3n inadecuada de los elementos especiales utilizados en un problema de comando OS (\u0027inyecci\u00f3n de comando de os\u0027) existe en el firmware UD-LT2 ver.1.00.008_SE y anterior. Si un atacante inicia sesi\u00f3n en el producto afectado con una cuenta administrativa y manipula las solicitudes de una determinada operaci\u00f3n de pantalla, se puede ejecutar un comando Arbitrary OS. Esta vulnerabilidad se inform\u00f3 en una operaci\u00f3n de pantalla diferente de CVE-2025-20617.\"}],\"affected\":[{\"source\":\"vultures@jpcert.or.jp\",\"affectedData\":[{\"vendor\":\"I-O DATA DEVICE, INC.\",\"product\":\"UD-LT2\",\"versions\":[{\"version\":\"firmware Ver.1.00.008_SE and earlier\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"vultures@jpcert.or.jp\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-20T16:15:09.554134Z\",\"id\":\"CVE-2025-26856\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"vultures@jpcert.or.jp\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"references\":[{\"url\":\"https://jvn.jp/en/jp/JVN15293958/\",\"source\":\"vultures@jpcert.or.jp\"},{\"url\":\"https://www.iodata.jp/support/information/2025/01_ud-lt2/\",\"source\":\"vultures@jpcert.or.jp\"}]}}",
    "redhat_vex": {
      "current_release_date": "2025-05-28T17:23:55+00:00",
      "cve": "CVE-2025-26856",
      "id": "CVE-2025-26856",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2025-26856",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-26856.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-26856\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-20T16:15:09.554134Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-20T16:15:17.023Z\"}}], \"cna\": {\"metrics\": [{\"format\": \"CVSS\", \"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 7.2, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en-US\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"I-O DATA DEVICE, INC.\", \"product\": \"UD-LT2\", \"versions\": [{\"status\": \"affected\", \"version\": \"firmware Ver.1.00.008_SE and earlier\"}]}], \"references\": [{\"url\": \"https://www.iodata.jp/support/information/2025/01_ud-lt2/\"}, {\"url\": \"https://jvn.jp/en/jp/JVN15293958/\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper neutralization of special elements used in an OS command (\u0027OS Command Injection\u0027) issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. If an attacker logs in to the affected product with an administrative account and manipulates requests for a certain screen operation, an arbitrary OS command may be executed. This vulnerability was reported on a different screen operation from CVE-2025-20617.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en-US\", \"type\": \"CWE\", \"cweId\": \"CWE-78\", \"description\": \"Improper neutralization of special elements used in an OS command (\u0027OS Command Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"ede6fdc4-6654-4307-a26d-3331c018e2ce\", \"shortName\": \"jpcert\", \"dateUpdated\": \"2025-02-20T05:49:49.402Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-26856\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-02-20T16:15:20.874Z\", \"dateReserved\": \"2025-02-17T00:29:49.508Z\", \"assignerOrgId\": \"ede6fdc4-6654-4307-a26d-3331c018e2ce\", \"datePublished\": \"2025-02-20T05:49:49.402Z\", \"assignerShortName\": \"jpcert\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.