CVE-2025-49002: high-severity vulnerability in dataease
Dataease H2 Database Remote Code Execution (RCE) Bypass Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
DataEase versions before 2.10.10 allow attackers to bypass security protections and execute malicious code on the server by using different letter cases (uppercase/lowercase variations) to hide prohibited commands. This lets attackers take full control of the affected system.
The vulnerability exists in DataEase's H2 database command filtering mechanism, where case-insensitive bypass techniques circumvent the prohibition on INIT and RUNSCRIPT keywords. An attacker can craft requests using case variations (e.g., 'Init', 'RunScript') to achieve remote code execution with high privileges, requiring network access to the DataEase instance but no authentication or user interaction.
In the same product, most dangerous first.