What’s Vulnerable › Vulnerabilities

CVE-2025-2605: Authenticated command injection

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 16.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-05-02 · updated 2026-06-17
• Weakness: CWE-78

Description

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Honeywell MB-Secure allows Privilege Abuse. This issue affects MB-Secure: from V11.04 before V12.53 and MB-Secure PRO from V01.06 before V03.09.Honeywell also recommends updating to the most recent version of this product.

Affected products

• Honeywell Mb-Secure Firmware: from 11.04 before 12.53 — fixed in 12.53
• Honeywell Mb-Secure Pro Firmware: from 01.06 before 03.09 — fixed in 03.09

How to fix

Upgrade to a fixed version: Honeywell Mb-Secure Firmware 12.53; Honeywell Mb-Secure Pro Firmware 03.09. Check the vendor advisory for mitigations.

References

• https://www.honeywell.com/us/en/product-security#security-notices
• http://seclists.org/fulldisclosure/2025/May/19

Get alerted when CVE-2025-2605 or the next vulnerability affects your stack