How severe is CVE-2018-25159?

CVE-2018-25159 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2018-25159 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (31st percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2018-25159?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2018-25159 have an EU (EUVD) identifier?

Yes. CVE-2018-25159 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2018-21653.

When was CVE-2018-25159 published?

CVE-2018-25159 was published on 2026-03-11 and last updated on 2026-06-17.

CVE-2018-25159

CVE-2018-25159 is a critical-severity vulnerability with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1334.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v4: 9.3
EPSS exploit prediction: 0% (31st percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2018-21653
Weakness: CWE-1334
Published: 2026-03-11
Last modified: 2026-06-17

Description

Epross AVCON6 systems management platform contains an object-graph navigation language (OGNL) injection vulnerability that allows unauthenticated attackers to execute arbitrary commands by injecting malicious OGNL expressions. Attackers can send crafted requests to the login.action endpoint with OGNL payloads in the redirect parameter to instantiate ProcessBuilder objects and execute system commands with root privileges.

Frequently asked questions

What is CVE-2018-25159?: Epross AVCON6 systems management platform contains an object-graph navigation language (OGNL) injection vulnerability that allows unauthenticated attackers to execute arbitrary commands by injecting malicious OGNL expressions. Attackers can send crafted requests to the login.action endpoint with OGNL payloads in the redirect parameter to instantiate ProcessBuilder objects and execute system commands with root privileges.
How severe is CVE-2018-25159?: CVE-2018-25159 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2018-25159 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (31st percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2018-25159?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2018-25159 have an EU (EUVD) identifier?: Yes. CVE-2018-25159 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2018-21653.
When was CVE-2018-25159 published?: CVE-2018-25159 was published on 2026-03-11 and last updated on 2026-06-17.

References

Other CWE-1334 vulnerabilities

CVE-2022-41804 — High (CVSS 7.2): Unauthorized error injection in Intel(R) SGX or Intel(R) TDX for some Intel(R) Xeon(R) Processors may allow a…

Browse all CWE-1334 vulnerabilities →