CVE-2025-20094: defense platform (CVSS 8.8)

Description

Unprotected Windows messaging channel ('Shatter') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker sends a specially crafted message to the specific process of the Windows system where the product is running, arbitrary code may be executed with SYSTEM privilege.

Is your site exposed to CVE-2025-20094?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.8

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness Type (CWE)

CWE-422 CWE-422

Affected Products

Vendor	Product	Versions
hummingheads	defense_platform	< 3.9.51.0

References

Other References

https://jvn.jp/en/jp/JVN66673020/ https://www.hummingheads.co.jp/dep/storelist/

Frequently Asked Questions

What is CVE-2025-20094? +

Unprotected Windows messaging channel ('Shatter') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker sends a specially crafted message to the specific process of the Windows system where the product is running, arbitrary code may be executed with SYSTEM privilege. It has a CVSS v3.1 base score of 8.8 (HIGH).

How severe is CVE-2025-20094? +

CVE-2025-20094 has a CVSS v3.1 score of 8.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2025-20094? +

CVE-2025-20094 affects products from hummingheads, specifically: defense_platform. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-20094? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-22894 8.8

Unprotected Windows messaging channel ('Shatter') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker sends a …

CVE-2025-22890 8.8

Execution with unnecessary privileges issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker performs a specific …

CVE-2025-23236 8.8

Buffer overflow vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker performs a specific operation, SYSTEM …

CVE-2025-24483 5.5

NULL pointer dereference vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker provides specially crafted data …

CVE-2025-24845 5.5

Improper neutralization of argument delimiters in a command ('Argument Injection') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. …

CVE-2025-20094