CVE-2025-0781

Incorrect Authorization in SimGear

CVSS 8.6 HIGHEPSS 0.3%CWE-863

Vexday Risk Score

21Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 8.6EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

28 ene 2025Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

An attacker can bypass the sandboxing of Nasal scripts and arbitrarily write to any file path that the user has permission to modify at the operating-system level.

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Productos afectados

FlightGear · SimGear

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://gitlab.com/flightgear/flightgear/-/commit/ad37afce28083fad7f79467b3ffdead753584358 https://gitlab.com/flightgear/flightgear/-/issues/3025 https://gitlab.com/flightgear/simgear/-/commit/5bb023647114267141a7610e8f1ca7d6f4f5a5a8 https://lists.debian.org/debian-lts-announce/2025/01/msg00028.html https://lists.debian.org/debian-lts-announce/2025/01/msg00029.html