CVE-2025-66620 Columbia Weather Systems CVE debrief

Who should care

Organizations operating Columbia Weather Systems MicroServer firmware, especially teams responsible for embedded or industrial/OT environments and anyone managing admin access to these devices.

Technical summary

According to the CISA CSAF advisory, the MicroServer contains an unused webshell that allows unlimited login attempts and has sudo rights on certain files and directories. The advisory says an attacker with admin access to the MicroServer can gain limited shell access, enabling persistence via reverse shells and the ability to modify or remove data stored in the filesystem. The published CVSS vector is AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which indicates high impact but also that elevated privileges and adjacent-network conditions are part of the stated attack context.

Defensive priority

High. The impact is severe for confidentiality, integrity, and availability, and CISA published a vendor fix. The issue is not described as requiring public exploitation or being KEV-listed, but affected firmware should still be prioritized for upgrade because the downside includes persistence and filesystem tampering.

Recommended defensive actions

• Update MicroServer firmware to version MS_4.1_14142 or later, per Columbia Weather Systems guidance.
• If immediate updating is not possible, restrict and closely monitor administrative access to the MicroServer.
• Review device exposure and limit adjacent-network access paths to the firmware management interface.
• Validate filesystem integrity and look for unauthorized changes on affected systems.
• Follow CISA industrial control system recommended practices and defense-in-depth guidance for segmentation, access control, and monitoring.

Evidence notes

All statements are derived from the supplied CISA CSAF source item and the official reference links included in the corpus. The advisory revision history shows initial publication and a same-day revision that updated risk evaluation, research acknowledgment, and vendor mitigations. No exploit code or unverified exploitation details are included.

Official resources