Security readout for executives and security teams
Plain-English summary
Kados R10 GreenBee has an unauthenticated SQL injection flaw in the menu_lev1 parameter. A remote attacker could potentially read sensitive database information or change database contents. Public exploit information exists, but the provided sources do not show confirmed active exploitation.
Executive priority
Treat this as a high-priority exposure review for any organization running Kados R10 GreenBee. The issue is remotely reachable without login and has public exploit information. Urgency is highest for internet-facing deployments or systems storing sensitive data.
Technical view
CVE-2019-25688 is CWE-89 SQL injection in Kados GreenBee R10. The CVSS 4.0 score is 8.8, with network access, low complexity, no privileges, and no user interaction required. The reported impact is high confidentiality and low integrity impact through manipulation of backend database queries via menu_lev1.
Likely exposure
Exposure is most likely where Kados R10 GreenBee is deployed and reachable over a network, especially internet-facing instances. The sources do not identify other affected versions or products. Organizations should verify whether this specific product and release are present before assuming impact.
Exploitation context
ExploitDB is listed as a public exploit reference, indicating public technical exploit information exists. However, CISA KEV status is false in the supplied data, and no cited source confirms active exploitation in the wild.
Researcher notes
The evidence identifies Kados R10 GreenBee only, with no CPEs or named fixed version in the provided bundle. The CVE record reports CVSS 4.0 8.8 and CWE-89. Avoid broad version assumptions until vendor or advisory data confirms scope.
Mitigation direction
- Check Kados or trusted advisory sources for vendor remediation guidance.
- Identify and prioritize any internet-facing Kados R10 GreenBee deployments.
- Restrict external access to affected systems where business operations allow.
- Increase monitoring for suspicious requests involving the menu_lev1 parameter.
- Plan replacement or isolation if no supported fix is available.
Validation and detection
- Inventory web applications for Kados GreenBee R10 installations.
- Confirm exposure from internal and external network perspectives.
- Review application logs for suspicious menu_lev1 parameter activity.
- Check whether databases contain unexpected changes or access patterns.
- Track CVE, VulnCheck, and vendor pages for remediation updates.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-89: Database access and collection lookup
Injection into data stores can inform collection, data access, and exfiltration detection reviews. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2019-25688 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.8HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-46505CVE reference · exploit
- Official Product HomepageCVE reference · product
- Product ReferenceCVE reference · product
- VulnCheck Advisory: Kados R10 GreenBee SQL Injection via menu_lev1 ParameterCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.