CVE-2025-6225 - CVE House
Back to Database
Status published Medium CVE-2025-6225

Command injection in Kieback&Peter Neutrino-GLT

Vulnerability Description

Kieback&Peter Neutrino-GLT product is used for building management. It's web component "SM70 PHWEB" is vulnerable to shell command injection via login form. The injected commands would execute with low privileges. The vulnerability has been fixed in version 9.40.02

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-6225

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Jan Barszcz

References

More from Kieback&Peter

View All →
CVE-2024-43812
Kieback&Peter DDC4000 Series Path Traversal Insufficiently Protected Credentials
High 8.6
CVE-2024-43698
Kieback&Peter DDC4000 Series Use of Weak Credentials
Critical 9.3

Affected Vendor

Kieback&Peter

View all reports →

Affected Software

Neutrino-GLT
Vulnerable Versions:
0

Timeline

Official Publish: January 7th, 2026
Last Modified: January 7th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-78

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1005 Data from Local System
Collection
T1041 Exfiltration Over C2 Channel
Exfiltration