External risk intelligence

MaLion MaLionCloud HTTP Header Buffer Overflow Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-62691

The vulnerability exists in MaLion and MaLionCloud, which are management and monitoring solutions. Because the vulnerability involves processing HTTP headers from remote, unauthenticated attackers and the software includes cloud-based components, it is likely to be deployed in a manner that faces the internet or is accessible across network boundaries in common operational configurations.

Buffer Overflow

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in MaLion and MaLionCloud security software that could allow remote attackers to execute code with system privileges by sending specially crafted web requests. The main concern is confirming relevance and exposure.

Attackers can run unauthorized code on systems.
Protects against remote takeover of security software.
Confirm if our MaLion/MaLionCloud is affected.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request over the network to a vulnerable MaLion or MaLionCloud instance. The system's handling of malformed HTTP headers in this request could be manipulated to trigger a buffer overflow, potentially allowing the attacker to execute arbitrary code with high-level system privileges.

No attacker authentication required.
Malformed HTTP header processing.
Arbitrary code execution with SYSTEM privileges.

Live Threat

Current exploitation, exposure, and threat context

A stack-based buffer overflow in processing HTTP headers could allow an unauthenticated remote attacker to execute arbitrary code with SYSTEM privileges on affected systems. This could occur when the system processes a specially crafted request.

System-level code execution.
Receiving specially crafted HTTP requests.
Complete system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in MaLion and MaLionCloud's Security Point likely falls under the responsibility of the platform or infrastructure teams managing the MaLion deployment, in coordination with the security team for exposure assessment and the vendor-management team for potential vendor-supplied fixes. The immediate first step is to identify all instances of the affected technology, confirm their accessibility from external networks, and assess their criticality to business operations to prioritize remediation efforts.

Platform/Infrastructure teams own the issue.
Verify external reachability and business criticality.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MaLion and what does it do?

MaLion and MaLionCloud are management and monitoring software solutions. Organizations use this platform for centralized administration, security oversight, and tracking operations across their Windows-based IT environment.

What is the vulnerability in CVE-2025-62691?

This CVE involves a stack-based buffer overflow, categorized as CWE-121. It occurs when the software fails to safely manage the memory space used for incoming data. Specifically, when the application processes a malformed HTTP header, it can overwrite adjacent memory, potentially allowing an attacker to run their own unauthorized instructions with high-level SYSTEM privileges.

How does an attacker trigger this vulnerability?

The flaw is triggered when the software receives a specially crafted HTTP request from a remote source. Because this happens during the initial processing of network headers, an attacker does not need to provide any credentials or authenticate with the system first. Simply sending the malformed data packet is sufficient to attempt exploitation.

How do I know if my environment is at risk?

According to Halo Surface Signal, this vulnerability is likely relevant if your MaLion deployment is reachable from the internet or accessible across network boundaries. Since the software includes cloud-based components and is designed for broad management visibility, you should check if your instances are exposed to untrusted networks rather than kept strictly internal.

What should I do to protect my systems?

First, create an inventory of all instances of MaLion and MaLionCloud running in your environment. Confirm their network accessibility to determine which are internet-facing. Coordinate with your infrastructure and security teams to monitor vendor communications for official updates and prioritize the implementation of any patches once they become available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.