CVE-2025-10589: N-Partner｜N-Reporter, N-Cloud, N-Probe - OS Command Injection

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-17 · updated 2026-06-17
Weakness: CWE-78

Description

The N-Reporter, N-Cloud, and N-Probe developed by N-Partner has an OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the server.

Affected products

N-Partner N-Cloud: from 6 before 6.1.187; from 7 before 7.0.009 — fixed in 6.1.187, 7.0.009
N-Partner N-Probe: from 6 before 6.1.187; from 7 before 7.0.009 — fixed in 6.1.187, 7.0.009
N-Partner N-Reporter: from 6 before 6.1.187; from 7 before 7.0.009 — fixed in 6.1.187, 7.0.009

How to fix

Upgrade to a fixed version: N-Partner N-Cloud 6.1.187, 7.0.009; N-Partner N-Probe 6.1.187, 7.0.009; N-Partner N-Reporter 6.1.187, 7.0.009. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-10589 or the next vulnerability affects your stack