CVE-2025-24845

Improper neutralization of argument delimiters in a command ('Argument Injection') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker provides specially crafted data to the specific process of the Windows system where the product is running, the system may cause a Blue Screen of Death (BSOD), and as a result, cause a denial-of-service (DoS) condition.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://jvn.jp/en/jp/JVN66673020/	Third Party Advisory
https://www.hummingheads.co.jp/dep/storelist/	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:hummingheads:defense_platform:*:*:*:*:home:*:*:*

History

30 Jan 2026, 21:05

Type	Values Removed	Values Added
First Time		Hummingheads Hummingheads defense Platform
CVSS	v2 : ~~unknown~~ v3 : ~~6.3~~	v2 : unknown v3 : 5.5
References	~~() https://jvn.jp/en/jp/JVN66673020/ -~~	() https://jvn.jp/en/jp/JVN66673020/ - Third Party Advisory
References	~~() https://www.hummingheads.co.jp/dep/storelist/ -~~	() https://www.hummingheads.co.jp/dep/storelist/ - Product
CPE		cpe:2.3:a:hummingheads:defense_platform:::::home:::*
Summary		(es) Existe un problema de neutralización incorrecta de los delimitadores de argumentos en un comando ('Inyección de argumentos') en Defense Platform Home Edition Ver.3.9.51.x y versiones anteriores. Si un atacante proporciona datos especialmente manipulados al proceso específico del sistema Windows donde se ejecuta el producto, el sistema puede provocar una pantalla azul de la muerte (BSOD) y, como resultado, provocar una condición de denegación de servicio (DoS).

06 Feb 2025, 08:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-02-06 08:15

Updated : 2026-01-30 21:05

NVD link : CVE-2025-24845

Mitre link : CVE-2025-24845

CVE.ORG link : CVE-2025-24845

JSON object : View

Products Affected

hummingheads

defense_platform

CWE

CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

{"id": "CVE-2025-24845", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "vultures@jpcert.or.jp", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 1.8}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2025-02-06T08:15:30.673", "references": [{"url": "https://jvn.jp/en/jp/JVN66673020/", "tags": ["Third Party Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "https://www.hummingheads.co.jp/dep/storelist/", "tags": ["Product"], "source": "vultures@jpcert.or.jp"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "vultures@jpcert.or.jp", "description": [{"lang": "en", "value": "CWE-88"}]}], "descriptions": [{"lang": "en", "value": "Improper neutralization of argument delimiters in a command ('Argument Injection') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker provides specially crafted data to the specific process of the Windows system where the product is running, the system may cause a Blue Screen of Death (BSOD), and as a result, cause a denial-of-service (DoS) condition."}, {"lang": "es", "value": "Existe un problema de neutralizaci\u00f3n incorrecta de los delimitadores de argumentos en un comando ('Inyecci\u00f3n de argumentos') en Defense Platform Home Edition Ver.3.9.51.x y versiones anteriores. Si un atacante proporciona datos especialmente manipulados al proceso espec\u00edfico del sistema Windows donde se ejecuta el producto, el sistema puede provocar una pantalla azul de la muerte (BSOD) y, como resultado, provocar una condici\u00f3n de denegaci\u00f3n de servicio (DoS)."}], "lastModified": "2026-01-30T21:05:58.620", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hummingheads:defense_platform:*:*:*:*:home:*:*:*", "vulnerable": true, "matchCriteriaId": "6B192BB2-AB8A-49B5-A8EC-06D30F135E87", "versionEndIncluding": "3.9.51.0"}], "operator": "OR"}]}], "sourceIdentifier": "vultures@jpcert.or.jp"}