CVE-2025-56814

Vulnerability

The Launcher Plugin for OpenCPN v5.12.0 (plugin version v1.3.5) contains a command injection vulnerability in the wxExecute() function. The LauncherUIDialog::OnBtnClick handler in launcher_pi.cpp directly passes a user-defined command string to wxExecute(cmd, wxEXEC_ASYNC) without any sanitization or escaping. This allows an attacker to embed shell metacharacters (e.g., ;, ` `, |`) in the command, which are interpreted by the underlying system shell.

Exploitation

An attacker must have the ability to configure or provide a malicious button definition to the Launcher Plugin. When a victim clicks the button, the plugin builds the command string (including any injected metacharacters) and feeds it to the shell. The proof-of-concept code from the reference demonstrates that no filtering occurs before the wxExecute() call. The attack requires user interaction (clicking the button), but no special privileges beyond those needed to load a chart or configuration that contains the malicious command.

Impact

Successful exploitation results in arbitrary code execution with the same privileges as the OpenCPN process. On Windows (the vulnerable environment described in the reference), this could lead to full system compromise, data exfiltration, or further lateral movement within the network, depending on the runtime context.

Mitigation

As of the publication date, no official patch has been released for CVE-2025-56814. The vendor recommends avoiding the use of user-defined commands from untrusted sources, or disabling the Launcher Plugin entirely until a fix is applied. Users should treat any third-party configuration files as potentially malicious and inspect them for unexpected shell metacharacters [1].