External risk intelligence

HGiga iSherlock OS Command Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-11900

The vulnerability affects iSherlock, which is a security appliance. Such appliances are typically deployed as edge services or gateways to monitor network traffic. Because the vulnerability allows unauthenticated remote command injection, and these devices are commonly positioned at the network perimeter to intercept and inspect external traffic, they are likely to be reachable from the internet.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in iSherlock, a security appliance, that allows unauthenticated remote attackers to inject and execute arbitrary commands on the server. This could potentially lead to unauthorized control over the affected systems. The main concern is confirming the relevance and exposure of this product within your environment.

Unauthenticated attackers can run commands remotely.
This could allow unauthorized control of systems.
Confirm iSherlock relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could reach the iSherlock server over the network, as no authentication is required. This allows them to send specially crafted input to a vulnerable feature, leading to the execution of arbitrary operating system commands on the server. The lack of authentication and direct network access indicates a significant risk of compromise.

No authentication needed to access.
Vulnerable feature accepts arbitrary commands.
Arbitrary command execution on server.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to execute arbitrary operating system commands on the affected server, when supported by the advisory.

Server OS commands could be executed.
Arbitrary commands could be injected remotely.
Server integrity and behavior may be compromised.

Operational Fix

Recommended remediation, mitigation, and detection steps

To address the OS command injection vulnerability in iSherlock, the first practical step is to identify all instances of this technology within your environment. Subsequently, determine their network exposure, business criticality, and confirm the accountable system owner. This information will inform a risk-based remediation plan, potentially involving coordination with HGiga.

Determine iSherlock application ownership.
Verify network exposure and criticality.
Plan remediation with HGiga vendor.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is iSherlock and how is it used?

iSherlock, developed by HGiga, is a security appliance typically deployed as an edge service or network gateway. Organizations use this technology to monitor network traffic, perform inspection, and act as a control point for data flowing through their perimeters.

What does OS Command Injection mean for CVE-2025-11900?

This vulnerability, classified as CWE-78, occurs when software improperly processes input, allowing an attacker to insert their own commands into the operating system. In the context of this CVE, it means the system will execute unauthorized instructions as if they were legitimate administrative tasks.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending specially crafted input to a vulnerable feature on the server without needing any login credentials. This is not triggered by standard network traffic; it requires specific, malicious input designed to bypass command validation.

Is my iSherlock device at risk?

Halo Surface Signal notes that because iSherlock acts as a network perimeter gateway, it is often directly reachable from the internet. If your instance is positioned at the network edge to intercept external traffic, it is likely exposed to these unauthenticated remote attempts.

What are the first steps to address this CVE?

Begin by creating an inventory to locate every iSherlock device in your network. Once found, verify if each instance is internet-facing, document who owns the system, and reach out to HGiga to coordinate the necessary remediation actions.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.