In engineer mode service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.4 | CVE-2025-31713 |
Exploitation
To exploit this vulnerability, an attacker with local access could send specially crafted commands to the engineer mode service, taking advantage of the improper input validation to execute arbitrary commands and escalate privileges without needing additional execution rights.
Affected Products
- Engineer Mode Service: This service is vulnerable due to improper input validation, allowing for command injection.
Mitigation
It is recommended to validate all inputs rigorously in the engineer mode service to prevent command injection vulnerabilities. Additionally, restricting access to the engineer mode service can help mitigate potential exploitation.