External risk intelligence

ThinPLUS OS Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-13284

The vulnerability allows unauthenticated remote command injection. Because the flaw is exploitable without authentication over a network, it is inherently designed to be reachable and interact with external or remote requests in its normal deployment, consistent with edge or public-facing server services.

OS Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in ThinPLUS software that allows unauthorized remote attackers to execute arbitrary commands on the server. This issue could enable attackers to compromise server operations without needing any credentials.

Unauthenticated attackers can run commands on servers.
Critical flaw allows remote control of affected systems.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by sending specially crafted network requests to a vulnerable ThinPLUS server. If successful, the attacker could inject and execute arbitrary operating system commands on the server, potentially leading to a complete compromise of the system.

No authentication required.
Triggered by network requests.
Arbitrary command execution risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to execute arbitrary operating system commands on the server. This is possible when the affected system is accessible over a network and not protected by additional security measures.

Server OS commands could be executed.
Unauthenticated network access can trigger it.
Server compromise is a realistic consequence.

Operational Fix

Recommended remediation, mitigation, and detection steps

This OS Command Injection vulnerability in ThinPLUS impacts systems where the application is deployed and exposed to remote, unauthenticated access. Ownership will likely fall to the application or platform teams responsible for ThinPLUS, with close collaboration from network and security teams to assess exposure and manage the attack surface. The first practical move is to identify all ThinPLUS instances, confirm their network reachability and business criticality, and then engage the accountable owners to plan remediation.

Application/platform teams own the vulnerability.
Verify ThinPLUS instances and network exposure.
Plan remediation based on risk and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ThinPLUS software?

ThinPLUS is a software solution used by organizations to manage server-side operations. It functions as a platform that handles incoming network requests to perform various tasks on the underlying operating system. Because it interacts directly with the server environment to process these requests, it requires secure handling of input to maintain system integrity.

What does OS Command Injection mean for CVE-2025-13284?

This vulnerability falls under the weakness class of OS Command Injection (CWE-78). In simple terms, it means the software does not properly filter the information it receives from users. An attacker can use this flaw to slip malicious system-level commands into a normal request, tricking the server into running those commands with its own authority.

How is this command injection vulnerability triggered?

The flaw is triggered when an attacker sends a specially crafted network request to the ThinPLUS server without needing to provide any login credentials. It is important to note that the issue relies on the server processing these malicious inputs; legitimate, expected traffic that does not contain unauthorized command syntax will not trigger the vulnerability.

Is my ThinPLUS server at risk if it is internal?

According to Halo Surface Signal, this vulnerability is classified as external because it can be exploited by unauthenticated remote attackers over a network. While public-facing servers are at the highest risk, any system reachable via your network could potentially be targeted. Assessing whether your specific instances are accessible to untrusted network segments is a key part of determining your risk.

What should I do if I am running ThinPLUS?

Your first step is to locate all instances of ThinPLUS across your environment to understand your footprint. Once you have an inventory, coordinate with your platform and application teams to verify the network reachability of these servers. Prioritize checking systems that are accessible from the network, and work with your security team to develop a remediation plan to secure these assets.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.