From 752ef7879a1ff03065e1d764082947bc1dc925e4 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Sun, 25 May 2025 09:35:27 +0000
Subject: [PATCH] Publish GHSA-p2qp-gwg4-3p43

---
 .../GHSA-p2qp-gwg4-3p43.json                  | 52 +++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 advisories/unreviewed/2025/05/GHSA-p2qp-gwg4-3p43/GHSA-p2qp-gwg4-3p43.json

diff --git a/advisories/unreviewed/2025/05/GHSA-p2qp-gwg4-3p43/GHSA-p2qp-gwg4-3p43.json b/advisories/unreviewed/2025/05/GHSA-p2qp-gwg4-3p43/GHSA-p2qp-gwg4-3p43.json
new file mode 100644
index 00000000000..dfdd77f89e8
--- /dev/null
+++ b/advisories/unreviewed/2025/05/GHSA-p2qp-gwg4-3p43/GHSA-p2qp-gwg4-3p43.json
@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-p2qp-gwg4-3p43",
+  "modified": "2025-05-25T09:33:47Z",
+  "published": "2025-05-25T09:33:47Z",
+  "aliases": [
+    "CVE-2025-5146"
+  ],
+  "details": "A vulnerability has been found in Netcore NBR1005GPEV2, B6V2, COVER5, NAP830, NAP930, NBR100V2 and NBR200V2 up to 20250508 and classified as critical. This vulnerability affects the function passwd_set of the file /usr/bin/routerd of the component HTTP Header Handler. The manipulation of the argument pwd leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5146"
+    },
+    {
+      "type": "WEB",
+      "url": "https://anonymous.4open.science/r/netcore_command_injection2-4583F2DA"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?ctiid.310234"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?id.310234"
+    },
+    {
+      "type": "WEB",
+      "url": "https://vuldb.com/?submit.573493"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-74"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-25T07:15:19Z"
+  }
+}
\ No newline at end of file