CVE-2025-2239 - Vulnerability Details - OpenCVE

Generation of Error Message Containing Sensitive Information vulnerability in Hillstone Networks Hillstone Next Generation FireWall.This issue affects Hillstone Next Generation FireWall: from 5.5R8P1 before 5.5R8P23.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://www.hillstonenet.com.cn/security-notification/2025/02/17/stoneosjd/

History

Wed, 12 Mar 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 12 Mar 2025 10:00:00 +0000

Type	Values Removed	Values Added
Description		Generation of Error Message Containing Sensitive Information vulnerability in Hillstone Networks Hillstone Next Generation FireWall.This issue affects Hillstone Next Generation FireWall: from 5.5R8P1 before 5.5R8P23.
Title		Absolute Path Disclosure Vulnerability in Hillstone Next Generation FireWall
Weaknesses		CWE-209
References		https://www.hillstonenet.com.cn/security-notification/2025/02/17/stoneosjd/
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: Hillstone

Published: 2025-03-12T09:53:35.677Z

Updated: 2025-03-12T14:18:30.762Z

Reserved: 2025-03-12T02:07:06.724Z

Link: CVE-2025-2239

Vulnrichment

Updated: 2025-03-12T14:18:23.844Z

NVD

Status : Received

Published: 2025-03-12T10:15:19.940

Modified: 2025-03-12T10:15:19.940

Link: CVE-2025-2239

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-2239", "assignerOrgId": "2b565742-f273-46f9-b583-07c1fcdea31a", "state": "PUBLISHED", "assignerShortName": "Hillstone", "dateReserved": "2025-03-12T02:07:06.724Z", "datePublished": "2025-03-12T09:53:35.677Z", "dateUpdated": "2025-03-12T14:18:30.762Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["StoneOS"], "product": "Hillstone Next Generation FireWall", "vendor": "Hillstone Networks", "versions": [{"lessThan": "5.5R8P23", "status": "affected", "version": "5.5R8P1", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Generation of Error Message Containing Sensitive Information vulnerability in Hillstone Networks Hillstone Next Generation FireWall.This issue affects Hillstone Next Generation FireWall: from 5.5R8P1 before 5.5R8P23."}], "value": "Generation of Error Message Containing Sensitive Information vulnerability in Hillstone Networks Hillstone Next Generation FireWall.This issue affects Hillstone Next Generation FireWall: from 5.5R8P1 before 5.5R8P23."}], "impacts": [{"capecId": "CAPEC-116", "descriptions": [{"lang": "en", "value": "CAPEC-116 Excavation"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-209", "description": "CWE-209 Generation of Error Message Containing Sensitive Information", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "2b565742-f273-46f9-b583-07c1fcdea31a", "shortName": "Hillstone", "dateUpdated": "2025-03-12T09:56:14.295Z"}, "references": [{"url": "https://www.hillstonenet.com.cn/security-notification/2025/02/17/stoneosjd/"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Upgrade the NGWF device to version 5.5R8P23 or higher."}], "value": "Upgrade the NGWF device to version 5.5R8P23 or higher."}], "source": {"discovery": "EXTERNAL"}, "title": "Absolute Path Disclosure Vulnerability in Hillstone Next Generation FireWall", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "If an upgrade is not feasible in the short term, we advise mitigating the risk by configuring a \"Trusted Host Access\" policy.\n\n\n\n<br>"}], "value": "If an upgrade is not feasible in the short term, we advise mitigating the risk by configuring a \"Trusted Host Access\" policy."}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-12T14:14:22.419551Z", "id": "CVE-2025-2239", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-12T14:18:30.762Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-2239", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-12T14:14:22.419551Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-12T14:18:23.844Z"}}], "cna": {"title": "Absolute Path Disclosure Vulnerability in Hillstone Next Generation FireWall", "source": {"discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-116", "descriptions": [{"lang": "en", "value": "CAPEC-116 Excavation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Hillstone Networks", "product": "Hillstone Next Generation FireWall", "versions": [{"status": "affected", "version": "5.5R8P1", "lessThan": "5.5R8P23", "versionType": "custom"}], "platforms": ["StoneOS"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade the NGWF device to version 5.5R8P23 or higher.", "supportingMedia": [{"type": "text/html", "value": "Upgrade the NGWF device to version 5.5R8P23 or higher.", "base64": false}]}], "references": [{"url": "https://www.hillstonenet.com.cn/security-notification/2025/02/17/stoneosjd/"}], "workarounds": [{"lang": "en", "value": "If an upgrade is not feasible in the short term, we advise mitigating the risk by configuring a \"Trusted Host Access\" policy.", "supportingMedia": [{"type": "text/html", "value": "If an upgrade is not feasible in the short term, we advise mitigating the risk by configuring a \"Trusted Host Access\" policy.\n\n\n\n<br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Generation of Error Message Containing Sensitive Information vulnerability in Hillstone Networks Hillstone Next Generation FireWall.This issue affects Hillstone Next Generation FireWall: from 5.5R8P1 before 5.5R8P23.", "supportingMedia": [{"type": "text/html", "value": "Generation of Error Message Containing Sensitive Information vulnerability in Hillstone Networks Hillstone Next Generation FireWall.This issue affects Hillstone Next Generation FireWall: from 5.5R8P1 before 5.5R8P23.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-209", "description": "CWE-209 Generation of Error Message Containing Sensitive Information"}]}], "providerMetadata": {"orgId": "2b565742-f273-46f9-b583-07c1fcdea31a", "shortName": "Hillstone", "dateUpdated": "2025-03-12T09:56:14.295Z"}}}, "cveMetadata": {"cveId": "CVE-2025-2239", "state": "PUBLISHED", "dateUpdated": "2025-03-12T14:18:30.762Z", "dateReserved": "2025-03-12T02:07:06.724Z", "assignerOrgId": "2b565742-f273-46f9-b583-07c1fcdea31a", "datePublished": "2025-03-12T09:53:35.677Z", "assignerShortName": "Hillstone"}, "dataVersion": "5.1"}