CVE-2025-49002: DataEase patch bypass allows case-insensitive command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote, unauthenticated code execution with public exploit references and very high EPSS, though not yet in KEV and requiring some attack complexity.

What it is

DataEase versions before 2.10.10 contain an incomplete fix for CVE-2025-32966: the blocklist that prohibits INIT and RUNSCRIPT can be bypassed because the check is case-insensitive, letting those commands through. This matters because the underlying flaw is a remote code execution path in an open source BI tool, and no workarounds exist other than upgrading.

Impact

An attacker can execute arbitrary commands on the DataEase server, leading to full compromise of the host and any data it can reach.

Attack surface

Reachable over the network with no authentication and no user interaction required, per the CVSS 4.0 vector (AV:N/PR:N/UI:N). The specific endpoint is not named in the record, so defenders should treat any interface that reaches the vulnerable command-handling logic as exposed.

Exploitation

Not listed in CISA KEV, but EPSS is 0.50266 (98.8th percentile) and both advisory references are tagged Exploit, indicating public exploit material exists. No ransomware usage is documented.

What to do

• Upgrade DataEase to version 2.10.10 or later, which contains the fix.
• If immediate upgrade is impossible, restrict network access to the DataEase service to trusted hosts only, since no official workaround exists.
• Audit for any prior exploitation attempts before patching, as the flaw predates the fix.
• Monitor DataEase release notes and advisories for any follow-up bypasses of the same command blocklist.

Detection

• Search DataEase logs for INIT and RUNSCRIPT command strings in any casing, including mixed case variants.
• Alert on unexpected child processes spawned by the DataEase service account.
• Monitor outbound network connections from the DataEase host to unfamiliar destinations.
• Review access logs for unauthenticated requests to endpoints that handle command or script input.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.