NetSight
IP …
high8.4

CVE-2025-12737

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input.

Impact

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.

Affected products

VendorProductAffected versions
Wso2Api Control Plane
from 4.5.0 before 4.5.0.36
Version 4.6.0
Wso2Api Manager
from 3.1.0 before 3.1.0.349
from 3.2.0 before 3.2.0.453
from 3.2.1 before 3.2.1.73
from 4.0.0 before 4.0.0.373
from 4.1.0 before 4.1.0.236
from 4.2.0 before 4.2.0.176
Wso2Identity Server
from 5.10.0 before 5.10.0.378
from 5.11.0 before 5.11.0.425
from 6.0.0 before 6.0.0.252
from 6.1.0 before 6.1.0.253
from 7.0.0 before 7.0.0.130
from 7.1.0 before 7.1.0.38
Wso2Identity Server As Key Manager
from 5.10.0 before 5.10.0.369
Wso2Open Banking Am
from 2.0.0 before 2.0.0.398
Wso2Open Banking Iam
from 2.0.0 before 2.0.0.418
Wso2Traffic Manager
from 4.5.0 before 4.5.0.34
Version 4.6.0
Wso2Universal Gateway
from 4.5.0 before 4.5.0.34
Version 4.6.0

Weakness classification

CWE-78

References