Read the docs
TI-2025-00374 Aliases CVE-2025-0457GHSA-2ghg-c3m2-fxfm

NetVision Information airPASS - OS Command Injection

Priority MEDIUM 42CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

The airPASS from NetVision Information has an OS Command Injection vulnerability, allowing remote attackers with regular privileges to inject and execute arbitrary OS commands.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00971 62nd percentileScored 2026-11-07
Fix Fixed airPASS (NetVision Information): 2.9.0.241231, 3.0.0.241231

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NetVision InformationairPASS2.9.0 to before 2.9.0.241231; 3.0.0 to before 3.0.0.2412312.9.0.241231, 3.0.0.241231Patch availableCNA
  • airPASS VendorNetVision Information Affected 2.9.0 to before 2.9.0.241231; 3.0.0 to before 3.0.0.241231 Fixed in 2.9.0.241231, 3.0.0.241231 Patch available CNA

Remediation

  • Fix · CNA airPASS (NetVision Information) Fixed in 2.9.0.241231, 3.0.0.241231

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    NetVision Information airPASS 2.9.0.241231, 3.0.0.241231

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2025-00373 NetVision Information airPASS - Missing AuthenticationPriority MEDIUM 50
    • TI-2025-00372 NetVision Information airPASS - SQL injectionPriority MEDIUM 50
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-0457
  2. 2026-10-03 Alias added: GHSA-2ghg-c3m2-fxfm

References

Advisory 2

  • TI-2025-00373 NetVision Information airPASS - Missing Authentication CVSS 3.1CRITICAL 9.8
  • TI-2025-00372 NetVision Information airPASS - SQL injection CVSS 3.1CRITICAL 9.8
  • TI-2025-00970 NetVision Information ISOinsight - Reflected Cross-site Scripting CVSS 3.1MEDIUM 6.1
  • TI-2025-14007 NetVision Information｜ISOinsight - Reflected Cross-site Scripting CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences