Read the docs
TI-2025-08700 Aliases CVE-2025-9494GHSA-75cp-gjjh-3r55

Viessmann Vitogate 300 OS Command Injection

Priority MEDIUM 40CWE-78Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

An OS command injection vulnerability has been discovered in the Vitogate 300, which can be exploited by malicious users to compromise affected installations. Specifically, the `/cgi-bin/vitogate.cgi` endpoint is affected, when the `form` JSON parameter is set to `form-0-2`. The vulnerability stems from the fact that that function at offset 0x21c24 does not properly sanitize supplied input before interpolating it into a format string which gets passed to `popen()`. Consequently, an authenticated attacker is able to inject arbitrary OS commands and thus gain code execution on affected devices.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00675 52nd percentileScored 2026-11-07
Fix Fixed Vitogate 300 (Viessmann): 3.1.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ViessmannVitogate 3001 to before 3.1.0.03.1.0.0Patch availableCNA
  • Vitogate 300 VendorViessmann Affected 1 to before 3.1.0.0 Fixed in 3.1.0.0 Patch available CNA

Remediation

  • Fix · CNA Vitogate 300 (Viessmann) Fixed in 3.1.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-9494
  2. 2026-10-03 Alias added: GHSA-75cp-gjjh-3r55

References

Other 1

  • TI-2023-24609 In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to… CVSS 3.1CRITICAL 9.8
  • TI-2023-04802 Viessmann Vitogate 300 Web Management Interface vitogate.cgi isValidUser hard-coded password CVSS 3.1CRITICAL 9.8
  • TI-2023-05245 Viessmann Vitogate 300 direct request CVSS 3.1MEDIUM 6.5
  • TI-2025-08701 Viessmann Vitogate 300 Authentication Bypass CVSS 4.0HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences