What’s Vulnerable › Vulnerabilities

CVE-2025-14097: Remote Code Execution Vulnerability in Radiometer Products

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-17 · updated 2026-06-17
• Weakness: CWE-287

Description

A vulnerability in the application software of multiple Radiometer products may allow remote code execution and unauthorized device management when specific internal conditions are met. Exploitation requires that a remote connection is established with additional information obtained through other means. The issue is caused by a weakness in the analyzer’s application software.                                                                                                                                                                                                Other related CVE's are CVE-2025-14095 & CVE-2025-14096.                                                                                                      Affected customers have been informed about this vulnerability. This CVE is being published to provide transparency. Required Configuration for Exposure: Affected application software version is in use and remote support feature is enabled in the analyzer.                                                                                                                                                                        Temporary work Around: If the network is not considered secure, please remove the analyzer from the network.                         Permanent solution: Customers should ensure the following: • The network is secure, and access follows best practices. Local Radiometer representatives will contact all affected customers to discuss a permanent solution.                                                      Exploit Status: Researchers have provided working proof-of-concept (PoC). Radiometer is not aware of any publicly available exploits at the time of this publication.

Affected products

• Radiometer Medical Aps ABL800 BASIC and ABL800 FLEX Analyzers: Application software versions < 6.20MR2 with Windows 7, Windows XP operating systems
• Radiometer Medical Aps ABL90 FLEX and ABL90 FLEX PLUS Analyzers: Application software versions < 3.5MR11 with Windows 7, Windows XP operating systems
• Radiometer Medical Aps AQT90 FLEX Analyzers: Application software versions <= 8.13 MR2 with Windows 7, Windows XP operating systems

References

• https://www.radiometer.com/myradiometer

Get alerted when CVE-2025-14097 or the next vulnerability affects your stack