Read the docs
TI-2025-41015 Aliases CVE-2025-66620GHSA-mh3m-m8m5-x43f

Columbia Weather Systems MicroServer Command Shell in Externally Accessible Directory

Priority MEDIUM 40CWE-553Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

An unused webshell in MicroServer allows unlimited login attempts, with sudo rights on certain files and directories. An attacker with admin access to MicroServer can gain limited shell access, enabling persistence through reverse shells, and the ability to modify or remove data stored in the file system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00464 40th percentileScored 2026-11-07
Fix Fixed MicroServer (Columbia Weather Systems): MS_4.1_14142

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Columbia Weather SystemsMicroServerbefore MS_4.1_14142MS_4.1_14142Patch availableCNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:columbiaweather:weather_microserver_firmware:*:*:*:*:*:*:*:*before MS_4.1_14142VulnerableColumbiaweather
cpe:2.3:h:columbiaweather:weather_microserver:-:*:*:*:*:*:*:*not specified by NVDRunning onColumbiaweather
  • cpe:2.3:o:columbiaweather:weather_microserver_firmware:*:*:*:*:*:*:*:* Versions before MS_4.1_14142 Vulnerable ·Columbiaweather
  • cpe:2.3:h:columbiaweather:weather_microserver:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Columbiaweather

Remediation

  • Fix · CNA MicroServer (Columbia Weather Systems) Fixed in MS_4.1_14142

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Columbia Weather Systems MicroServer MS_4.1_14142

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2025-38287 Columbia Weather Systems MicroServer Improper Restriction of Communication Channel to Intended EndpointsPriority LOW 39
    • TI-2025-39743 Columbia Weather Systems MicroServer Cleartext Storage in a File or on DiskPriority LOW 30
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66620
  2. 2026-10-03 Alias added: GHSA-mh3m-m8m5-x43f
  3. 2026-10-07 Priority changed: MEDIUM → LOW
  4. 2026-10-09 Priority changed: LOW → MEDIUM

References

Advisory 2

  • TI-2025-39743 Columbia Weather Systems MicroServer Cleartext Storage in a File or on Disk CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences