logo_clicknbuy.png

CVE-2025-27364 – Caldera Remote Code Execution Vulnerability

The following table lists the changes that have been made to the
CVE-2025-27364 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution
of a vulnerability, and for identifying the most recent changes that may
impact the vulnerability’s severity, exploitability, or other characteristics.

  • CVE Modified
    by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Feb. 24, 2025

    Action Type Old Value New Value
    Added Reference https://medium.com/@mitrecaldera/mitre-caldera-security-advisory-remote-code-execution-cve-2025-27364-5f679e2e2a0e
  • New CVE Received
    by [email protected]

    Feb. 24, 2025

    Action Type Old Value New Value
    Added Description In MITRE Caldera through 4.2.0 and 5.0.0 before 35bc06e, a Remote Code Execution (RCE) vulnerability was found in the dynamic agent (implant) compilation functionality of the server. This allows remote attackers to execute arbitrary code on the server that Caldera is running on via a crafted web request to the Caldera server API used for compiling and downloading of Caldera’s Sandcat or Manx agent (implants). This web request can use the gcc -extldflags linker flag with sub-commands.
    Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    Added CWE CWE-78
    Added Reference https://github.com/mitre/caldera/commit/35bc06e42e19fe7efbc008999b9f993b1b7109c0
    Added Reference https://github.com/mitre/caldera/pull/3129
    Added Reference https://github.com/mitre/caldera/pull/3131/commits/61de40f92a595bed462372a5e676c2e5a32d1050
    Added Reference https://github.com/mitre/caldera/releases
    Added Reference https://github.com/mitre/caldera/security
    Added Reference https://medium.com/@mitrecaldera/mitre-caldera-security-advisory-remote-code-execution-cve-2025-27364-5f679e2e2a0e
Share the Post:

Related Posts