Riskcovery

CVE-2025-7097

Comodo Internet Security Premium Manifest File cis_update_x64.xml os command injection

State
Published
Severity
9.2 Critical
Published
Jul 6, 2025
Updated
Jul 7, 2025
Reserved
Jul 5, 2025

Read the record on cve.org

Description

A vulnerability, which was classified as critical, has been found in Comodo Internet Security Premium 12.3.4.8162. This issue affects some unknown processing of the file cis_update_x64.xml of the component Manifest File Handler. The manipulation of the argument binary/params leads to os command injection. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

CVSSScoreVectorSource
4.09.2 CriticalCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:PVulDB
3.18.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:RVulDB
3.08.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:RVulDB
2.07.6 HighAV:N/AC:H/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:URVulDB

Weaknesses

Affected Products

ProductVersions
Internet Security PremiumComodo
  • 12.3.4.8162Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.