CVE-2025-3399 is a high severity (CVSS 7.3) SQL injection in ESAFENET CDG build 5.6.3.154.205_20250114. The ID argument of /pubinfo/updateNotice.jsp reaches a database query unsafely. The record says the vendor did not respond to the disclosure, so no fix is confirmed. Restrict access and ask ESAFENET for a patch.
What's affected
The record lists ESAFENET CDG 5.6.3.154.205_20250114 as affected. The vulnerable file is /pubinfo/updateNotice.jsp, and the argument involved is ID. The record does not give a range of earlier or later builds, so do not assume other builds are safe.
No fixed version is confirmed in the record or in the pages reviewed for this post. Ask the vendor for current status and check its advisory before you rely on any version number. The record also states that the vendor was contacted early about this disclosure and did not respond in any way, and that the exploit has been disclosed to the public. That combination means you should plan for compensating controls rather than waiting.
How to check if you're exposed
Find out whether CDG is deployed and which build it runs. The build string is normally visible in the product console or in the installer or package name. If it reads 5.6.3.154.205_20250114, treat the system as affected.
Then ask who can reach the web interface. The record says the attack can be launched remotely and the CVSS vector shows no privileges are required, so network reachability is the main factor. Check firewall rules and reverse proxy configuration for the CDG web port, and review web server logs for unusual requests to /pubinfo/updateNotice.jsp and for database error messages in responses.
This is a shipped product or appliance, not a package you import, so a manifest scan will not list it. Use your asset inventory, procurement records or network discovery to find every instance, then compare the version you find against the fixed version in the vendor notes. Safeguard's free in-browser dependency scan and the Gold directory are useful for the open source parts of your estate, and you can look up this CVE in Gold to see how it is tracked.
What to do now
- Inventory every ESAFENET CDG server and record the build string.
- Remove direct internet exposure. Place the interface behind a VPN or an allow list of known admin and client networks.
- If you operate a web application firewall, add monitoring for requests to /pubinfo/updateNotice.jsp and tune rules for SQL injection patterns on the ID argument. Treat this as a stopgap.
- Contact ESAFENET and ask in writing for a fixed build and a date. Record the answer in your risk register.
- Review database accounts used by the application and reduce them to the least privilege the product needs.
- Check logs from before today for odd requests to the affected file, and escalate if you find any.
Why it matters
The weakness is CWE-89, SQL injection, a form of CWE-74, injection. A value supplied by the requester becomes part of a database query without being separated from the query text. Anyone who controls part of a query can change what it reads or writes.
The CVSS score of 7.3 reflects low impact on each of confidentiality, integrity and availability, but with network access, no privileges and no user interaction needed. Impact in your environment depends on what the CDG database holds and which database account the application uses. The record does not mark this CVE as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalogue. Public disclosure still lowers the bar for attackers.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a fixed version of ESAFENET CDG for this CVE?
None is confirmed in the record, which says the vendor did not respond. Ask ESAFENET directly and use compensating controls until you get an answer.
Is this CVE known to be exploited?
The record does not flag it as exploited and it is not on the CISA KEV list. A public disclosure exists, so treat the risk as real.
Sources
- Public report cited in the record (could not be retrieved when this post was reviewed)
- VulDB entry cited in the record
Last reviewed: 18 October 2026.
