2.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-48756

CVE-2025-48756: SCSIR has a Potential Unsound Issue in WriteSameCommand

In group_number in the scsir crate 0.2.0 for Rust, there can be an overflow because a hardware device may expect a small number of bits (e.g., 5 bits) for group number.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-48756

CVE-2025-48756:

2.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
scsir	rust	<= 0.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability CVE-2025-48756 exists in the scsir crate (version <= 0.2.0) because the WriteSameCommand::group_number function does not validate that the input value conforms to the hardware-defined bit-width for the 'group number' field in SCSI Write Same commands (typically 5 bits).

The group_number function directly assigns the provided u8 value to an internal field. This field is later used by the issue_10, issue_16, and issue_32 functions to populate the respective command buffers (CommandBuffer10, CommandBuffer16, CommandBuffer32). These command buffer structures define group_number as a 5-bit field. If a value larger than what can be represented in 5 bits (i.e., > 31) is passed to the group_number function, it will be truncated when written into the command buffer. This truncation leads to the SCSI device receiving a different group_number than intended, potentially causing an overflow or other undefined behavior on the hardware device.

The issue report (https://github.com/maboroshinokiseki/scsir/issues/4) explicitly points out this lack of input validation in the group_number function and provides a proof-of-concept that demonstrates the overflow by calling scsi.write().group_number(255).issue_16().

While later versions of the code (as seen in the fetched file content, which might be newer than 0.2.0) include a check (bitfield_bound_check!) within an error_check function that is called by issue_10/16/32, the vulnerability lies in the fact that in version 0.2.0 and earlier, this check was either not present or not effective in the group_number setter itself, allowing an invalid value to be stored and subsequently used.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.