- An error in critical difficulty was found in the Command Command Center
- It allows threat players to run arbitrary code externally and without approval
- Vulnerability can lead to complete compromise
WatchTowr CyberSecurity scientists recently discovered an error in critical difficulty in the Command Command Center that could allow threat players to run arbitrary code external and without approval.
The Command Command Center is a web -based interface that provides centralized data protection management, backup, improvement and adherence across hybrid environments used by thousands of businesses around the world across industries such as healthcare, economy, government and manufacture.
Vulnerability is traced as CVE-2025-34028 and has a severity of 9.0/10 (critical).
Other increase
“A critical safety vulnerability has been identified in the installation of the command center, enabling external attackers to perform arbitrary code without approval,” the security counseling said.
“This vulnerability can lead to a complete compromise with the command center environment. Fortunately, other installations within the same system are not affected by this vulnerability.”
Since this error allows remote attackers to perform arbitrary code without approval, a threat actor could take advantage of it to gain unauthorized access to, for example, a government’s backup system.
Once inside, they could manipulate or delete sensitive data, interfere with surgery or install malware to maintain control.
This can lead to data violations, operational downtime and loss of public trust. Ultimately, if classified information ends up being postponed, they can turn into a national security question.
Several versions are affected by vulnerability: 11.38 Innovation release, from versions 11.38.0 to 11.38.19. Users who want to mitigate the error must go in versions 11.38.20 and 11.38.25.
So far, there is no evidence of abuse in nature yet, and there is no proof-of-concept (POC) yet. However, most threat actors are not looking for zero-day vulnerabilities, but rather are waiting for security researchers to find and patch a mistake.
They bet that many users do not patch their final points on time, remain vulnerable and thus easily exploited.
Via Hacker the news
