CVE-2025-8259 is a high severity (CVSS 7.3) OS command injection in VaelsysV4. A web interface handler in /grid/vgrid_server.php passes the xajaxargs argument on without enough checking. The fix is 5.1.1 for the VaelsysOS 10 line and 5.4.1 for the VaelsysOS 12 line.
What's affected
The vendor advisory gives a clearer picture than the record, so here are both.
The record says VaelsysV4 up to 5.1.0 and 5.4.0, fixed in 5.1.1 and 5.4.1. The vendor advisory breaks that down by platform:
- VaelsysOS 10: versions 4.0.0 to 5.1.0 are affected, fixed in 5.1.1.
- VaelsysOS 12: versions 5.1.1 to 5.4.0 are affected, fixed in 5.4.1.
- VaelsysOS 8 and Vifence3: all versions are affected. These products are discontinued and there is no fix.
On impact, the advisory says the commands run as the low privilege web server user. The vendor says a full system takeover is unlikely without a second privilege escalation flaw, but sensitive data could be read and the web interface could be altered. It also found that this channel allowed some operations without the required authentication check, and fixed that too.
Severity differs slightly in wording. The record scores the issue 7.3 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, and the advisory says about 7.3 from public sources. These agree.
How to check if you're exposed
Find the platform and version from the device's about or system page, then compare it with the list above. Remember that VaelsysOS 8 and Vifence3 have no fix at all.
Check whether the web interface is reachable from outside your trusted administration network.
curl -I https://your-vaelsys-host/
Run it from a network outside yours against your own device only. A normal response means the interface is exposed.
The vendor says upgrades can be applied with the device's integrated updating tool, so check there for an available update.
What to do now
- Identify each Vaelsys device, its platform (OS 8, 10 or 12) and version.
- Upgrade OS 10 devices to 5.1.1 and OS 12 devices to 5.4.1 using the integrated updating tool.
- Restrict the web interface to trusted administrative networks, as the vendor advises.
- Do not expose the web interface to public networks.
- Replace discontinued Vifence3 and VaelsysOS 8 devices with maintained VaelsysV4 systems.
- Review the web server and device logs for unexpected commands or configuration changes.
Why it matters
The record lists CWE-77 (Command Injection) and CWE-78 (OS Command Injection). The handler takes a value from the request and uses it where a shell command is built, so a crafted value can become part of the command. The vendor's fix blocks the injection and also suppresses command output.
Appliances like this one often sit in a management network that people assume is private. The advisory's own mitigation, keeping the interface off public networks, is the cheapest control you have. The record does not flag this CVE as CISA KEV, and neither the record nor the advisory claims exploitation in the wild, though the record says exploit details are publicly available.
Try it yourself
This demo shows how a fixed version is matched to an affected component so the upgrade is the first thing you see.
Click through it at your own pace, or open it full screen.
Quick check
Which Vaelsys versions are fixed?
VaelsysOS 10 is fixed in 5.1.1 and VaelsysOS 12 is fixed in 5.4.1, per the vendor advisory. VaelsysOS 8 and Vifence3 are discontinued with no fix.
Can this give someone full control of the device?
The vendor says commands run as the low privilege web server user, so a full takeover is unlikely without another flaw. That still allows reading data and changing the web interface, so patch anyway.
Sources
- CVE-2025-8259 on Safeguard Gold
- Vaelsys security advisory VSEC_V4_2025_07_0001
- NVD record for CVE-2025-8259, published 2025-07-28
Last reviewed: 18 October 2026.
