CVE-2025-69600

Vulnerability

Raynet rvia version 12.6.4392.49 (also affecting RayVentory Scan Engine 12.6 Update 8 and previous versions) contains command injection vulnerabilities in the getconfig, upload, inventory, and oracle options. The application constructs commands unsafely using user-supplied input without proper sanitization. For example, the getconfig option passes the URL argument directly into a shell command, and the oracle option does the same with the -o flag. Additionally, a separate argument injection flaw exists in the find command used to locate a Java runtime; a local attacker can create a crafted directory structure to force execution of arbitrary Java code. The vendor advisory RSEC200966 describes this as argument injection in the find command query [1].

Exploitation

A local attacker must have access to execute the rvia binary. No authentication is required beyond that. By passing a crafted argument such as \;command\; to the getconfig or oracle options, the attacker can inject arbitrary system commands. For the upload option, double quotes must be escaped and a # appended to ignore trailing arguments: \"\;command\;#. The inventory option is also directly vulnerable with the same injection pattern. For the find-based Java search flaw, the attacker creates a malicious directory structure with a name that satisfies the improperly terminated find query, placing a rogue Java executable that rvia will run [1].

Impact

Successful exploitation allows the attacker to execute arbitrary shell commands with the privileges of the rvia process (typically root or a dedicated service user). This can lead to full system compromise, including data exfiltration, installation of backdoors, or lateral movement. The CIA impact is complete: confidentiality, integrity, and availability are all at risk [1].

Mitigation

The Raynet advisory RSEC200966 recommends updating to RayVentory Scan Engine 12.6 Update 9 or later. If patching is not immediately possible, ensure that the ForbiddenCurlChars configuration property in /etc/rvia_configuration is set to restrict dangerous characters, and set the javaPaths option in /opt/rvia/rvia.cfg to a safe default to avoid the find command search path. However, these workarounds only partially mitigate the injection points; a vendor patch is the only complete fix [1].