CVE-2025-49002

DataEase is a tool businesses use to build dashboards and reports from their data. This bug is like a lock that was fixed to block one key, but a slightly different-shaped copy of the same key still opens it — attackers can walk straight into the server and take control, no password needed.

This matters to you if you run DataEase to build dashboards or reports, especially any version before 2.10.10. It affects any installation reachable from the internet or an internal network an attacker can access, with no login required to exploit it.

This is not yet confirmed as actively exploited in the wild, but it requires no login, no user action, and is reachable over the network by default — a serious combination for a critical-severity bug that bypasses a prior fix. Treat this as a priority to patch soon rather than an emergency fire, but don't leave it unaddressed.

Confirm exposure by checking your DataEase version string (via admin panel or deployment manifest); any version prior to 2.10.10 is vulnerable, including installs that already applied the CVE-2025-32966 patch, since that filter is case-sensitive and this bug bypasses it with lowercase 'init'/'runscript' commands. Upgrade to DataEase 2.10.10 or later — there is no documented workaround, so patching is the only remediation path. After upgrading, review access logs for any suspicious SQL-like payloads containing 'init' or 'runscript' (case-insensitive) sent to data-source or query endpoints prior to the patch, which would indicate attempted exploitation. Not listed in CISA KEV at this time; EPSS places exploitation likelihood in the high percentile with a rising trend, so monitor vendor advisories and threat intel for escalation to confirmed-exploited status.

CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects unauthenticated, network-reachable, full-impact remote code execution. Root cause is CWE-290 (Authentication Bypass by Spoofing/case-manipulation) — the prior patch for CVE-2025-32966 blocked uppercase H2 database commands INIT and RUNSCRIPT but not their lowercase equivalents, allowing the same underlying RCE vector to be reached via case variation. No public exploit code beyond a detection template is currently known, and it is not in CISA's KEV catalog, so exploitation is not yet confirmed in the wild. EPSS scores this at the 99th percentile with a rising trend, indicating strong predicted likelihood of near-term exploitation attempts despite lack of confirmed activity.