CVE-2025-57439
Last modified
CVE-2025-57439 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Creacast Creabox Manager 4.4.4 contains a critical Remote Code Execution vulnerability accessible via the edit.php endpoint. An authenticated attacker can inject arbitrary Lua code into the configuration, which is then executed on the server. EPSS estimates a 0.77% chance of exploitation in the next 30 days.
Description
Creacast Creabox Manager 4.4.4 contains a critical Remote Code Execution vulnerability accessible via the edit.php endpoint. An authenticated attacker can inject arbitrary Lua code into the configuration, which is then executed on the server. This allows full system compromise, including reverse shell execution or arbitrary command execution.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Creacast | Creabox Manager | 4.4.4 |
References
- http://www.creacast.com/Product
- https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-57439Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-57439?
How severe is CVE-2025-57439?
How do I fix CVE-2025-57439?
Are you affected by CVE-2025-57439?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST