Security readout for executives and security teams
Plain-English summary
CVE-2025-65854 describes a critical permission flaw in MineAdmin v3.x scheduled tasks. Sources say it can let attackers run arbitrary commands and take over an account. The CVSS vector indicates network access, low complexity, no privileges, and no user interaction. Public source data does not name a patch or precise affected build range.
Executive priority
Treat this as urgent for any MineAdmin v3.x deployment. The reported outcome includes command execution and account takeover with a critical CVSS score. Because official affected-version and fix data are incomplete, prioritize exposure discovery, access restriction, and vendor-follow-up before assuming remediation is available.
Technical view
The CVE maps to CWE-94 and describes improper control over code generation or execution through MineAdmin v3.x scheduled tasks. CVSS 3.1 is 9.8 with AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, supporting unauthenticated network exploitation with high confidentiality, integrity, and availability impact. Affected metadata is incomplete beyond MineAdmin v3.x references.
Likely exposure
Organizations running MineAdmin v3.x are the likely exposed population, especially where administrative or scheduled task functionality is reachable over a network. The CVE affected-product metadata lists n/a values, so exposure should be confirmed by local inventory and vendor records.
Exploitation context
The CVE is not listed as KEV in the provided bundle, and no cited source confirms active exploitation. However, the described impact is severe: arbitrary command execution and account takeover without privileges or user interaction, according to the CVSS vector and description.
Researcher notes
The source bundle provides a high-severity description, CWE-94, CVSS vector, MineAdmin v3.x wording, and references, but affected CPEs and exact versions are missing. Do not claim exploitation in the wild from this data. Validate scope using product inventory, configuration review, logs, and updated vendor/CVE records.
Mitigation direction
- Check MineAdmin vendor guidance and the CVE record for patched versions or official workarounds.
- Restrict network access to MineAdmin administrative interfaces and scheduled task functionality.
- Disable scheduled tasks if unused until vendor remediation is confirmed.
- Review existing scheduled tasks for unauthorized or unexpected entries.
- Audit MineAdmin accounts, credentials, and recent administrative changes.
Validation and detection
- Inventory all MineAdmin deployments and confirm whether any are v3.x.
- Verify scheduled task permissions match least-privilege expectations.
- Review application and system logs for unusual task creation or command execution.
- Confirm whether MineAdmin is internet-accessible or reachable from untrusted networks.
- Track CVE and vendor references for updated affected-version and remediation details.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-65854 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.mineadmin.com/CVE reference, mitre
- https://gist.github.com/SourByte05/1a6c6b08ac47c5d58eb7dd4422cc23b7CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Control of Generation of Code ('Code Injection')
Improper Control of Generation of Code ('Code Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.