CVE-2025-14213 PUBLISHED

Cato's Socket WebUI is vulnerable to OS Command Injection

Assigner: Cato
Reserved: 07.12.2025 Published: 31.03.2026 Updated: 31.03.2026

Cato Networks’ Socket versions prior to 25 contain a command injection vulnerability that allows an authenticated attacker with access to the Socket web interface (UI) to execute arbitrary operating system commands as the root user on the Socket’s internal system.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:H
CVSS Score: 8.3

Product Status

Vendor Cato Networks
Product Socket
Versions Default: unaffected
  • Version 24 and below is affected

References

Problem Types

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE
  • CWE-20 Improper Input Validation CWE

Impacts

  • CAPEC-88 OS Command Injection