CVE-2025-7095
Last modified
CVE-2025-7095 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. A vulnerability classified as critical has been found in Comodo Internet Security Premium 12.3.4.8162. This affects an unknown part of the component Update Handler. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
A vulnerability classified as critical has been found in Comodo Internet Security Premium 12.3.4.8162. This affects an unknown part of the component Update Handler. The manipulation leads to improper certificate validation. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Comodo | Internet Security | 12.3.4.8162 |
References
- https://drive.google.com/file/d/1qnWarYsTSc5_sV6o8ULv0LBvGfKKXPxn/view?usp=sharingExploit, Third Party Advisory
- https://vuldb.com/?ctiid.315009Permissions Required, VDB Entry
- https://vuldb.com/?id.315009Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.603712Third Party Advisory, VDB Entry
- https://drive.google.com/file/d/1qnWarYsTSc5_sV6o8ULv0LBvGfKKXPxn/viewExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-7095?
How severe is CVE-2025-7095?
How do I fix CVE-2025-7095?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-7092A vulnerability has been found in Belkin F9K1122 1.00.33 and…8.8
- CVE-2025-7093A vulnerability was found in Belkin F9K1122 1.00.33. It has …8.8
- CVE-2025-70936Vtiger CRM 8.4.0 contains a reflected cross-site scripting (…5.4
- CVE-2025-7094A vulnerability was found in Belkin F9K1122 1.00.33. It has …8.8
- CVE-2025-70948A host header injection vulnerability in the mailer componen…9.3
- CVE-2025-70949An observable timing discrepancy in @perfood/couch-auth v0.2…7.5
- CVE-2025-70950An issue in gohttp commit 34ea51 allows attackers to execute…7.3
- CVE-2025-70952pf4j before 20c2f80 has a path traversal vulnerability in th…7.5
- CVE-2025-70954A Null Pointer Dereference vulnerability exists in the TON V…7.5
- CVE-2025-70955A Stack Overflow vulnerability was discovered in the TON Vir…7.5
- CVE-2025-70956A State Pollution vulnerability was discovered in the TON Vi…7.5
- CVE-2025-70957A Denial of Service (DoS) vulnerability was discovered in th…7.5
Are you affected by CVE-2025-7095?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST