PT-2025-29823

CVE-2025-34300

Published

2025-04-09

Updated

2025-09-15

Description by

CVSS 4.0

Critical

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Sawtooth Lighthouse Studio versions prior to 9.16.14

Description A template injection vulnerability exists in the Perl web application ciwweb.pl within Sawtooth Lighthouse Studio, allowing unauthenticated attackers to execute arbitrary commands. Approximately 480 services are potentially affected worldwide.

Recommendations Update Sawtooth Lighthouse Studio to version 9.16.14 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Adam Kues

Vendors

Affected products

Weakness enumeration

CWE-20: Improper Input Validation

CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine