#### Remediation method (without upgrading)

**Method 1 — Block via ACL (recommended):**```bash
# Chặn toàn bộ nhóm lệnh blocking
redis-cli ACL SETUSER default -@blocking

# Hoặc chặn từng lệnh cụ thể
redis-cli ACL SETUSER default -BLPOP -BRPOP -BRPOPLPUSH -BLMOVE -BLMPOP \
                              -BZPOPMIN -BZPOPMAX -BZMPOP \
                              -WAIT -WAITAOF \
                              -XREAD -XREADGROUP

# Lưu ACL
redis-cli ACL SAVE

**Method 3 — Enable protected-mode and limit connections:**```bash
redis-cli CONFIG SET protected-mode yes
# Trong redis.conf:
protected-mode yes
bind 127.0.0.1

**Method 2 — Disable RESTORE (requires Redis restart):**```bash
# Thêm vào redis.conf:
rename-command RESTORE ""

### CVE-2026-25588

| Attribute    | Value                                                             |
| ------------ | ----------------------------------------------------------------- |
| **Title**    | Invalid Memory Access in RESTORE with RedisTimeSeries Module      |
| **CVSS 4.0** | **7.7 (HIGH)**                                                    |
| **CWE**      | CWE-20 + CWE-122                                                   |
| **Vector**   | `AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`           |
| **Condition**| Authenticated + RESTORE permission + **RedisTimeSeries module loaded** |
| **Scope**    | Redis OSS/CE + RedisTimeSeries module                              |

#### Technical Description

When the `RESTORE` command is used on an instance with the **RedisTimeSeries module** loaded, a specially crafted serialized payload can trigger invalid memory access during time-series data processing. The vulnerability lies in how the RedisTimeSeries module deserializes data from the RESTORE payload.

#### Indicators of Compromise

- Redis crash with a stack trace related to the RedisTimeSeries module
- RedisTimeSeries module is loaded (`MODULE LIST` shows timeseries)
- Unexpected command execution by redis-server

#### Mitigation Methods (without upgrading)

**Method 1 — Block RESTORE via ACL:** (same as CVE-2026-25243)```bash
redis-cli ACL SETUSER default -restore
redis-cli ACL SAVE

Then remove the following line from `redis.conf`:```
loadmodule /path/to/redistimeseries.so

---

### CVE-2026-25589

| Attribute    | Value                                                                        |
| ------------- | ----------------------------------------------------------------------------- |
| **Title**     | Invalid Memory Access in RESTORE with RedisBloom Module                       |
| **CVSS 4.0**  | **7.7 (HIGH)**                                                                |
| **CWE**       | CWE-20 + CWE-122 + CWE-787 (Out-of-Bounds Write) + CWE-190 (Integer Overflow) |
| **Vector**    | `AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`                      |
| **Condition** | Authenticated + RESTORE permission + **RedisBloom module loaded**             |
| **Scope**     | Redis OSS/CE + RedisBloom module                                              |

#### Technical Description

The vulnerability includes multiple sub-issues in the RedisBloom module when processing RESTORE payloads:

1. **Out-Of-Bounds read/write** (Daniel Firer) — reading/writing outside the allocated memory range
2. **Integer overflow, heap buffer overflow, and OOB read/write** (Joseph Surin) — integer overflow leading to heap buffer overflow

When the RedisBloom module is loaded, an attacker can send a specially crafted RESTORE payload to exploit the above errors during the deserialization of Bloom filter, Cuckoo filter, Count-Min Sketch, or Top-K data.

#### Indicators of Compromise

- Redis crash with a stack trace related to the RedisBloom module
- RedisBloom module is loaded (`MODULE LIST` shows bf/bloom)
- Data in Bloom filters is corrupted or abnormally altered

#### Mitigation (without upgrading)

**Method 1 — Block RESTORE via ACL:** (same as CVE-2026-25243)```bash
redis-cli ACL SETUSER default -restore
redis-cli ACL SAVE

Then remove the following line from `redis.conf`:```
loadmodule /path/to/redisbloom.so

---

### CVE-2026-23631

| Attribute    | Value                                                           |
| ------------ | --------------------------------------------------------------- |
| **Title**    | Lua Use-After-Free via Master-Replica Synchronization           |
| **CVSS 4.0** | **6.1 (MEDIUM)**                                                |
| **CWE**      | CWE-416 (Use After Free)                                        |
| **Vector**   | `AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N`        |
| **Condition**| Authenticated + **replica** with `replica-read-only` = **disabled** |
| **Scope**    | All Redis OSS/CE with Lua scripting, ONLY on replica            |
| **Codename** | "DarkReplica" (Yoni Shiraz, Wiz Zeroday Cloud)                  |

#### Technical Description

An authenticated attacker can exploit the master-replica synchronization mechanism to send specially crafted Lua scripts, triggering a use-after-free in the Lua engine on the replica.

**Critical condition:** The bug **only affects replicas** configured with `replica-read-only disabled` (i.e., a writable replica). This is **not** the default configuration — the default `replica-read-only` = `yes`.

If the replica is configured in read-only mode (default), the instance is **not affected**.

#### Indicators of Compromise

- Redis crash on the replica with a stack trace from the Lua engine
- `replica-read-only` configuration = `no` on the replica
- Execution of unknown commands on the replica
- Unauthorized network connections to the replica

#### Mitigation (without upgrading)

**Option 1 — Enable replica-read-only (recommended, this is the default):**```bash
# Runtime
redis-cli CONFIG SET replica-read-only yes

# Trong redis.conf:
replica-read-only yes

**Method 3 — Disable Lua commands (requires Redis restart):**```bash
# Thêm vào redis.conf:
rename-command EVAL ""
rename-command EVALSHA ""
rename-command SCRIPT ""
rename-command FUNCTION ""
rename-command FCALL ""
rename-command FCALL_RO ""

### System Requirements

- **Operating System:** Linux (Ubuntu, Debian, CentOS, RHEL, ...)
- **Tool:** `redis-cli` (usually included in the `redis-tools` or `redis` package)
- **Permissions:** Read/write access to the `redis.conf` file (for fixing)
- **Connection:** Network access to the Redis instance to be checked

### Installing redis-cli (if not already available)```bash
# Ubuntu/Debian
sudo apt update && sudo apt install -y redis-tools

# CentOS/RHEL 7
sudo yum install -y redis

# CentOS/RHEL 8+/Fedora
sudo dnf install -y redis

# Hoặc từ source
wget https://download.redis.io/releases/redis-stable.tar.gz
tar xzf redis-stable.tar.gz
cd redis-stable && make redis-cli
sudo cp src/redis-cli /usr/local/bin/

#### 2. Full CVE scan (diagnostic)```bash
# Local Redis
./CVE-2026-25589-25588-25243-23631-23479-REDIS.sh --scan

# Redis từ xa
./CVE-2026-25589-25588-25243-23631-23479-REDIS.sh --scan \
    -H 192.168.1.100 -p 6379 -a "your_password"

# Với ACL user
./CVE-2026-25589-25588-25243-23631-23479-REDIS.sh --scan \
    -H 10.0.0.50 -p 6380 -u admin -a "admin_password"

# Qua Unix socket
./CVE-2026-25589-25588-25243-23631-23479-REDIS.sh --scan \
    -s /var/run/redis/redis-server.sock

# Kèm xuất báo cáo
./CVE-2026-25589-25588-25243-23631-23479-REDIS.sh --scan \
    -o redis_cve_report_$(date +%Y%m%d).txt

#### 4. Group Quick Fix (recommended)```bash
# Chan RESTORE → bao ve 3/5 CVE (25243 + 25588 + 25589)
./CVE-2026-25589-25588-25243-23631-23479-REDIS.sh --fix-restore

# Chan blocking commands → bao ve CVE-2026-23479
./CVE-2026-25589-25588-25243-23631-23479-REDIS.sh --fix-blocking

# Chan Lua + bat replica-read-only → bao ve CVE-2026-23631
./CVE-2026-25589-25588-25243-23631-23479-REDIS.sh --fix-lua

### Full Parameter Table

#### Action Parameters (ACTION) — Required

| Parameter        | Function                                    | Number of CVEs Protected |
| ---------------- | ------------------------------------------- | ------------------------ |
| *(no parameter)* | Displays usage instructions                 | —                        |
| `--scan`         | Full diagnostic scan of all 5 CVEs          | —                        |
| `--fix-all`      | Fixes all CVEs                              | **5/5**                  |
| `--fix-restore`  | **[Fast]** Only blocks the RESTORE command  | **3/5** (25243, 25588, 25589) |
| `--fix-blocking` | **[Fast]** Only blocks blocking commands    | **1/5** (23479)          |
| `--fix-lua`      | **[Fast]** Blocks Lua + enables replica-read-only | **1/5** (23631)          |
| `--fix-cve-23479`| Fixes CVE-2026-23479                        | 1/5                      |
| `--fix-cve-25243`| Fixes CVE-2026-25243                        | 1/5                      |
| `--fix-cve-25588`| Fixes CVE-2026-25588                        | 1/5                      |
| `--fix-cve-25589`| Fixes CVE-2026-25589                        | 1/5                      |
| `--fix-cve-23631`| Fixes CVE-2026-23631                        | 1/5                      |

#### Connection Parameters

| Parameter            | Description              | Default     |
| -------------------- | ------------------------ | ----------- |
| `-H, --host HOST`    | Redis host address       | `127.0.0.1` |
| `-p, --port PORT`    | Redis port               | `6379`      |
| `-a, --pass PASS`    | Redis password           | *(empty)*   |
| `-u, --user USER`    | ACL username             | `default`   |
| `-s, --socket PATH`  | Unix socket path         | *(empty)*   |

#### Additional Parameters

| Parameter            | Description                              | Default                 |
| -------------------- | ---------------------------------------- | ----------------------- |
| `-h, --help`         | Displays help                            | —                       |
| `-c, --config FILE`  | Path to redis.conf                       | `/etc/redis/redis.conf` |
| `-o, --output FILE`  | Writes report to file (only with `--scan`) | *(empty)*             |
| `--redis-cli PATH`   | Path to redis-cli binary                 | `redis-cli` (from PATH) |
| `--no-backup`        | Do not back up config before modifying   | `false`                 |

### Exit Codes

| Code | Meaning                                                |
| ---- | ------------------------------------------------------ |
| `0`  | Success — no CVEs detected or fix completed            |
| `1`  | Error: redis-cli not found or unable to connect        |
| `2`  | `--scan` detected at least 1 CVE — remediation needed  |

### Scan Output (`--scan`)```
╔══════════════════════════════════════════════════════════════════════╗
║    REDIS CVE SCANNER & MITIGATION TOOL                               ║
╚══════════════════════════════════════════════════════════════════════╝

[*] THONG TIN REDIS INSTANCE
  Host:Port     : 127.0.0.1:6379
  Version       : 7.2.5
  Mode          : standalone
  Role          : master
  Modules       : timeseries bf

═══════════════════════════════════════════════════════════════════════
  [1/5] CVE-2026-23479 - Use-after-free trong Unblock Client Flow
        CVSS 7.7 (HIGH) | RCE
═══════════════════════════════════════════════════════════════════════
[✗] CO KHA NANG BI ANH HUONG - Redis 7.2.5 (can >= 7.2.14)

  ... (CVE 2-5 tuong tu)

╔══════════════════════════════════════════════════════════════════════╗
║                         TOM TAT KET QUA                              ║
╚══════════════════════════════════════════════════════════════════════╝
  [✗] CVE-2026-23479 - VULNERABLE
  [✗] CVE-2026-25243 - VULNERABLE
  [✗] CVE-2026-25588 - VULNERABLE
  [✗] CVE-2026-25589 - VULNERABLE
  [✓] CVE-2026-23631 - OK

  Ket qua: 1 PASS / 4 VULNERABLE

═══════════════════════════════════════════════════════════════════════
  [!] Phat hien 4 CVE. Su dung cac tuy chon --fix-... de khac phuc.
  VD: ./script.sh --fix-restore    # Chan RESTORE (3 CVE)
  VD: ./script.sh --fix-blocking   # Chan blocking (1 CVE)
  VD: ./script.sh --fix-lua        # Chan Lua (1 CVE)
  VD: ./script.sh --fix-all        # Khac phuc toan bo
═══════════════════════════════════════════════════════════════════════

---

## GENERAL REMEDIATION METHODS

### Method 1: ACL (Redis >= 6.0) — RECOMMENDED

This is the **safest and most flexible method**, requiring no Redis restart.```bash
# Tao ACL user an toan cho ung dung
redis-cli ACL SETUSER app_user on >StrongPassword123 ~* \
    +@read \           # Quyen doc du lieu
    +@write \          # Quyen ghi du lieu
    -@dangerous \      # CHAN tat ca lenh nguy hiem (gồm RESTORE)
    -@admin \          # CHAN lenh quan tri
    -@scripting \      # CHAN Lua scripting
    -@blocking \       # CHAN blocking commands
    -@keyspace \       # CHAN keyspace notifications
    -@pubsub           # CHAN pub/sub (neu khong dung)

# Vo hieu hoa default user
redis-cli ACL SETUSER default off

# Luu ACL vinh vien
redis-cli ACL SAVE

Then restart Redis:```bash
sudo systemctl restart redis-server
# hoặc
sudo service redis-server restart

### Method 4: Running Redis with minimal privileges```bash
# Tao user redis khong co shell
sudo useradd -r -s /bin/false redis

# Chown thu muc Redis
sudo chown -R redis:redis /var/lib/redis
sudo chown -R redis:redis /etc/redis

# Chay Redis duoi user redis
sudo -u redis redis-server /etc/redis/redis.conf

---

## RISK ASSESSMENT — INTERNAL REDIS SYSTEM / SENTINEL

This section applies to **Redis Sentinel** clusters or standalone Redis instances running on an internal network, protected by a firewall (Fortinet, iptables, etc.) and **with no direct Internet connectivity**.

### Summary

| Current protection level           | Risk mitigation?                                             | Upgrade needed?                         |
| ---------------------------------- | ------------------------------------------------------------ | --------------------------------------- |
| No Internet access                 | **Yes** — eliminates external attackers                       | Not urgent                              |
| Fortinet Firewall (with IPS/DPI)   | **Yes** — filters source IPs, IPS can detect anomalous payloads | Not urgent                              |
| iptables (source IP restrictions)  | **Yes** — only allowed IPs can connect to the Redis port      | Not urgent                              |
| **Combination of all three measures** | **Reduces exploitation probability to very low**              | **Not urgent, but a plan is advisable** |

### Key point: Why is a firewall not enough?

All 5 CVEs share a common trait: the attacker must **already be authenticated** to Redis (PR:L — Privileges Required: Low in the CVSS vector). A firewall blocks connections from unauthorized IPs, but it **does not protect** against the following threats:

| Threat                                                                                                            | Likelihood                | Impact if exploited                                                          |
| ----------------------------------------------------------------------------------------------------------------- | ------------------------- | ---------------------------------------------------------------------------- |
| **Malicious insider** — has internal network access + knows the Redis password                                    | Low but cannot be ruled out | **RCE** on the Redis server, privilege escalation, data theft                |
| **Compromised internal host (Lateral Movement)** — attacker breaches any machine on the network, then targets Redis | Medium                    | All Redis data stolen/altered/deleted; attacker may install a backdoor        |
| **Firewall misconfiguration** — accidentally exposing the Redis port externally due to an incorrect rule change    | Low                       | Equivalent to direct Internet exposure                                        |
| **Supply Chain / Third-Party** — partners or vendors with VPN access to the internal network                       | Low                       | RCE, data exfiltration                                                        |
| **Vulnerability in the firewall/network itself** — attacker bypasses the firewall through another flaw            | Very low                  | The entire internal system is affected                                        |

### Quantitative risk analysis```
Rủi ro = Xác suất khai thác × Hậu quả

Với firewall + air-gap:
  = (RẤT THẤP: 0.5% - 2%/năm) × (NGHIÊM TRỌNG: RCE toàn hệ thống, mất toàn bộ dữ liệu)
  = RỦI RO TRUNG BÌNH — vẫn đáng quan tâm

Tính năng này cho phép bạn tạo ra các báo cáo chi tiết về các lỗ hổng đã được phát hiện, bao gồm cả thông tin về mức độ nghiêm trọng, cách khai thác và các biện pháp khắc phục. Báo cáo có thể được xuất ra dưới dạng HTML, PDF hoặc Markdown, giúp bạn dễ dàng chia sẻ với đồng nghiệp hoặc khách hàng.```bash
# ============================================
# Chay tren TUNG node Sentinel (port 26379)
# ============================================

# Sentinel thuong khong can RESTORE/EVAL — chan toan bo lenh nguy hiem
redis-cli -h <sentinel_ip> -p 26379 -a <sentinel_pass> ACL SETUSER default \
    -@dangerous -@admin -@scripting -@blocking -restore

redis-cli -h <sentinel_ip> -p 26379 -a <sentinel_pass> ACL SAVE

### Conclusion

> **Firewall + network isolation reduces the exploit probability to a very low level, but the impact if exploited is still full-system RCE.** With a remediation cost of nearly zero (adding a few ACL lines without requiring a restart), applying the protective measure is a beneficial decision from a risk management perspective. **No need to panic and upgrade urgently**, but **the ACL workaround should be applied this week** and an upgrade should be scheduled for the next maintenance window.

---

## ACL REFERENCE

### Important command categories

| Category     | Description                                                                     | CVE Impact                   |
| ------------ | ------------------------------------------------------------------------------- | ---------------------------- |
| `@dangerous` | Dangerous commands (including RESTORE, FLUSHDB, FLUSHALL, KEYS, SHUTDOWN, DEBUG, CONFIG) | CVE-2026-25243, 25588, 25589 |
| `@blocking`  | Blocking commands (BLPOP, BRPOP, BZPOPMIN, XREAD, WAIT, ...)                     | CVE-2026-23479               |
| `@scripting` | Lua scripting (EVAL, EVALSHA, SCRIPT, FUNCTION, FCALL)                           | CVE-2026-23631               |
| `@admin`     | Administrative commands (CONFIG, ACL, CLIENT, CLUSTER, MONITOR, SHUTDOWN, ...)   | General protection           |
| `@keyspace`  | Keyspace-related commands (KEYS, SCAN, FLUSHDB, FLUSHALL, ...)                   | General protection           |
| `@read`      | Data read commands (GET, HGET, LRANGE, SMEMBERS, ZRANGE, ...)                    | Safe                         |
| `@write`     | Data write commands (SET, HSET, LPUSH, SADD, ZADD, ...)                          | Safe                         |

### Example of a complete ACL configuration```bash
# 1. Tao admin user (day du quyen)
redis-cli ACL SETUSER admin on >AdminPass123 ~* +@all

# 2. Tao app user (quyen gioi han)
redis-cli ACL SETUSER app on >AppPass123 ~* \
    +@read \
    +@write \
    -@dangerous \
    -@admin \
    -@scripting \
    -@blocking \
    -restore \
    -debug

# 3. Tao readonly user (chi doc)
redis-cli ACL SETUSER reader on >ReaderPass123 ~* \
    +@read \
    -@dangerous \
    -@admin \
    -@scripting

# 4. Vo hieu hoa default user
redis-cli ACL SETUSER default off

# 5. Luu ACL
redis-cli ACL SAVE

# 6. Kiem tra ACL
redis-cli ACL LIST

---

## PERIODIC TESTING PROCEDURE

### 1. One-time testing (ad-hoc)```bash
./CVE-2026-25589-25588-25243-23631-23479-REDIS.sh --scan \
    -H <redis_host> -p <port> -a <password> \
    -o report_$(date +%Y%m%d_%H%M%S).txt

Batch checking script:```bash
#!/bin/bash
# File: batch_check.sh

BATCH_RESULT="batch_result_$(date +%Y%m%d_%H%M%S).txt"

while IFS=':' read -r host port pass user; do
    [[ "$host" =~ ^#.* ]] && continue  # Bo qua comment
    [[ -z "$host" ]] && continue        # Bo qua dong trong

    echo "============================================" | tee -a "$BATCH_RESULT"
    echo "Kiem tra: $host:$port" | tee -a "$BATCH_RESULT"
    echo "============================================" | tee -a "$BATCH_RESULT"

    ./CVE-2026-25589-25588-25243-23631-23479-REDIS.sh --scan \
        -H "$host" -p "${port:-6379}" \
        -a "${pass:-}" -u "${user:-default}" \
        2>&1 | tee -a "$BATCH_RESULT"

    echo "" | tee -a "$BATCH_RESULT"
done < redis_hosts.txt

echo "Bao cao tong hop: $BATCH_RESULT"

### 4. Integration into CI/CD pipeline```yaml
# GitLab CI example
redis-security-scan:
  stage: security
  image: redis:7-alpine
  script:
    - chmod +x CVE-2026-25589-25588-25243-23631-23479-REDIS.sh
    - ./CVE-2026-25589-25588-25243-23631-23479-REDIS.sh --scan \
        -H $REDIS_HOST -p $REDIS_PORT -a $REDIS_PASS \
        -o cve_report.txt
  artifacts:
    paths:
      - cve_report.txt
    when: always
  allow_failure: true

The output will display the list of loaded modules along with their versions. If `timeseries` or `bf` is not visible, the module is not loaded.

### Q: Are `--fix-all` / `--fix-restore` / `--fix-...` safe for production?

**A:** The fix commands perform safe changes:

- Backs up redis.conf before modifying (unless using `--no-backup`)
- **ACL** (`-restore`, `-@blocking`, `-@scripting`): takes effect immediately, no downtime, easy to revert
- **rename-command**: requires a Redis restart to take effect
- **CONFIG SET**: runtime only, lost on restart if not written to redis.conf

Recommendation: For production, prioritize using `--fix-restore`, `--fix-blocking`, `--fix-lua` first (ACL only, no restart needed). Then schedule a maintenance window to restart with `rename-command`.

### Q: How do I roll back changes made by `--fix-...`?

**A:**

1. If backed up: copy the backup file over redis.conf, then restart Redis
2. If using `CONFIG SET`: restarting Redis will restore configuration from the file
3. If using `ACL SETUSER`: use `ACL SETUSER <user> +<cmd>` to restore permissions

### Q: Should I upgrade Redis?

**A:** **Yes, if possible.** Upgrading to a patched version is the most thorough solution. This script is intended for cases where:

- You cannot upgrade immediately due to application constraints
- You need time to test the new version
- You need temporary protection while waiting for a maintenance window

### Q: Redis runs internally, not exposed to the Internet, protected by a firewall — do I still need to upgrade?

**A:** **No urgent upgrade needed**, but **you should apply the workaround and have an upgrade plan** because:

- A firewall only reduces the **probability** of an attack, it does not completely eliminate the risk
- Attackers from within the internal network (malicious employees, compromised machines, lateral movement) can still exploit it
- The consequence if exploited is **system-wide RCE** — the highest severity level
- **The workaround cost is very low**: adding the ACL `-restore -@blocking -@scripting` takes 2 minutes, no downtime

**Recommended roadmap:**

1. **This week:** Apply the ACL workaround (no downtime)
2. **Next maintenance window:** Upgrade Redis + add `rename-command`

See details at [Risk assessment — Internal Redis / Sentinel system](#đánh-giá-rủi-ro--hệ-thống-redis-nội-bộ--sentinel).

---

## REFERENCES

- [Official Redis Security Advisory](https://redis.io/blog/security-advisory-cve202623479-cve202625243-cve-2026-25588-cve202625589-cve-2026-23631/)
- [GitHub Advisory — CVE-2026-25243 (RESTORE RCE)](https://github.com/redis/redis/security/advisories/GHSA-c8h9-259x-jff4)
- [GitHub Advisory — CVE-2026-23631 (Lua UAF)](https://github.com/redis/redis/security/advisories/GHSA-8ghh-qpmp-7826)
- [Redis ACL Documentation](https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl/)
- [Redis rename-command Documentation](https://redis.io/docs/latest/operate/oss_and_stack/management/security/#disable-specific-commands)
- [NVD — CVE-2026-25243](https://nvd.nist.gov/vuln/detail/CVE-2026-25243)
- [NVD — CVE-2026-25588](https://nvd.nist.gov/vuln/detail/CVE-2026-25588)
- [OpenCVE — CVE-2026-23479](https://app.opencve.io/cve/CVE-2026-23479)
- [Tenable — CVE-2026-23631](https://www.tenable.com/cve/CVE-2026-23631)

---

> **Disclaimer:** This document is compiled based on public information from the Redis security advisory and NVD sources. Users are responsible for verifying and confirming remediation measures appropriate to their environment before applying them.