JVN#11276793
Progress Flowmon vulnerable to authenticated OS command injection

Overview

Progress Flowmon provided by Progress Software Corporation contains an authenticated OS command injection vulnerability.

Products Affected

• Progress Flowmon versions prior to 12.5.5

Description

Progress Flowmon provided by Progress Software Corporation contains the following vulnerability.

• Authenticated OS command injection (CWE-78)
  • CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.6
  • CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Base Score 7.2
  • CVE-2025-10239

Impact

An authenticated user with administrative privileges may execute additional unintended commands.

Solution

Update the software
Update the software to the latest version according to the information provided by the developer.