A vulnerability has been found in the MSoft MFlash application that allows execution of arbitrary code on the server. The issue occurs in the integration configuration functionality available only to MFlash administrators. It is related to insufficient validation of parameters when setting up security components, affecting MFlash v. 8.0 and possibly others. To mitigate, apply hotfix 8.2-653 from 11.06.2025 and above.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.1 | CVE-2025-9060 |
Exploitation
To exploit this vulnerability, an attacker with administrative access to the MSoft MFlash application can manipulate the integration configuration settings. By providing malicious input that bypasses the insufficient validation of parameters, the attacker can execute arbitrary code on the server, potentially leading to a complete system compromise.
Affected Products
- MSoft MFlash v. 8.0: The primary version affected by the vulnerability.
- MSoft MFlash v. 8.2 and above: Potentially affected if not updated with the latest hotfix.
Mitigation
To mitigate this vulnerability, it is essential to apply the hotfix 8.2-653 released on 11.06.2025 or later. Regularly updating the application and monitoring for any security advisories from Kaspersky Labs can help prevent exploitation.