bilalclicksafe/cve-2025-60595SPH Engineering UgCS 5.13.0 is vulnerable to Arbitary code execution. This is the public refrence to be used on CVE site
SPH Engineering UgCS 5.13.0 is vulnerable to Arbitary code execution. This is the public refrence to be used on CVE site
Arbitary code execution on the product owned by SPH Engineering. UGCS 5.13.0! Ardupilot/mavparse.py direct lines being Lines 230 "243: on the sph engineering github we can see the parser reads XML attributes and sets value = eval(attrs['value']) If an attacker can craft an XML file with a malicious value attribute for example > import('os').system('touch /tmp/pwned')), eval will then execute it.
Impact: Code execution Attack type: Local
Discovered and report by clicksafe Clicksafe.pro
