CVE-2025-2012
CVSS 3.1 Score 7.2 of 10 (high)
Details
Published Mar 11, 2025
CWE ID 502
Summary
CVE-2025-2012 is a remote code execution vulnerability affecting Ashlar-Vellum Cobalt. The issue lies in the parsing of VS files, where insufficient validation of user-supplied data allows for an out-of-bounds read. This can result in the execution of arbitrary code in the context of the current process. User interaction is necessary for an attacker to exploit this vulnerability, typically through a malicious page or file. The discovery of this flaw was credited to ZDI under the identifier ZDI-CAN-25185.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Cisco Identity Services Engine
Affected Vendors
- Cisco