CVE-2025-2071

Critical

Description

A critical OS Command Injection vulnerability has been identified in the FAST LTA Silent Brick WebUI, allowing remote attackers to execute arbitrary operating system commands via specially crafted input. This vulnerability arises due to improper handling of untrusted input, which is passed directly to system-level commands without adequate sanitization or validation. Successful exploitation could allow attackers to execute arbitrary commands on the affected system, potentially resulting in unauthorized access, data leakage, or full system compromise. Affected WebUI parameters are "hd" and "pi".

SeverityCritical

CVSS10.0

Exploit probability—

ProductFAST LTA Silent Brick WebUI

PublishedMar 31, 2025

First seenMar 31, 2025

Weakness typeCWE-78OS command injection

How to fix

Update

FAST LTA FAST LTA Silent Brick WebUI2.63.04 or later

Vendor advisories

fast-lta.de/de/fast/silent-bricks-software-2-63

Affected products

Product	Affected versions	Fixed in
FAST LTA FAST LTA Silent Brick WebUI	WebUI Release 2.45 (Linux 5.4.109-gentoo-FAST) ≤ v < 2.63.04	2.63.04

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.