CVE-2025-54306

{
  "id": "CVE-2025-54306",
  "sourceIdentifier": "[email protected]",
  "published": "2025-12-04T15:15:59.030",
  "lastModified": "2026-11-04T22:10:00.210",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. A remote code execution vulnerability exists in the network configuration functionality, stemming from insufficient input validation when processing network configuration parameters through administrative endpoints. The application allows administrators to modify the server's network configuration through the Django application. This configuration is processed by Bash scripts (TSsetnoproxy and TSsetproxy) that write user-controlled data directly to environment variables without proper sanitization. After updating environment variables, the scripts execute a source command on /etc/environment; if an attacker injects malicious data into environment variables, this command can enable arbitrary command execution. The vulnerability begins with the /admin/network endpoint, which passes user-supplied form data as arguments to subprocess.Popen calls. The user-supplied input is then used to update environment variables in TSsetnoproxy and TSsetproxy, and finally source $environment is executed."
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en la aplicación Django Thermo Fisher Torrent Suite 5.18.1. Una vulnerabilidad de ejecución remota de código existe en la funcionalidad de configuración de red, derivada de una validación de entrada insuficiente al procesar parámetros de configuración de red a través de endpoints administrativos. La aplicación permite a los administradores modificar la configuración de red del servidor a través de la aplicación Django. Esta configuración es procesada por scripts Bash (TSsetnoproxy y TSsetproxy) que escriben datos controlados por el usuario directamente en variables de entorno sin una sanitización adecuada. Después de actualizar las variables de entorno, los scripts ejecutan un comando ’source’ en ’/etc/environment’; si un atacante inyecta datos maliciosos en las variables de entorno, este comando puede habilitar la ejecución arbitraria de comandos. La vulnerabilidad comienza con el endpoint ’/admin/network’, que pasa datos de formulario proporcionados por el usuario como argumentos a las llamadas ’subprocess.Popen’. La entrada proporcionada por el usuario se utiliza entonces para actualizar las variables de entorno en TSsetnoproxy y TSsetproxy, y finalmente se ejecuta ’source $environment’."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-12-05T19:59:47.816163Z",
          "id": "CVE-2025-54306",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:thermofisher:torrent_suite_software:5.18.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C9D40EC2-7E68-4166-9ECF-431E4294CB97"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://assets.thermofisher.com/TFS-Assets/LSG/manuals/MAN0026163-Torrent-Suite-5.18-UG.pdf",
      "source": "[email protected]",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://documents.thermofisher.com/TFS-Assets/CORP/Product-Guides/Ion_OneTouch_2_and_Torrent_Suite_Software.pdf",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://www.thermofisher.com/us/en/home/life-science/sequencing/next-generation-sequencing/ion-torrent-next-generation-sequencing-workflow/ion-torrent-next-generation-sequencing-data-analysis-workflow/ion-torrent-suite-software.html",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    }
  ]
}