CVE-2025-34300 is a critical security vulnerability identified in Sawtooth Software's Lighthouse Studio, specifically affecting versions prior to 9.16.14. The vulnerability is classified as a template injection flaw within the ciwweb.pl Perl web application component. Template injection vulnerabilities occur when user input is improperly validated or sanitized before being embedded into templates that are subsequently executed or rendered. In this case, the improper input validation (CWE-20) allows an unauthenticated attacker to inject malicious commands that the server executes arbitrarily. This vulnerability enables remote code execution (RCE) without requiring any authentication or user interaction, making it highly exploitable. The CVSS 4.0 base score of 10.0 reflects the maximum severity, indicating that the vulnerability is exploitable over the network (AV:N), requires no privileges (PR:N), no user interaction (UI:N), and results in high impact on confidentiality, integrity, and availability (VC:H, VI:H, VA:H). The scope is also high (SC:H), meaning the vulnerability affects resources beyond the vulnerable component itself. Although no known exploits have been reported in the wild yet, the critical nature and ease of exploitation make this a significant threat. Lighthouse Studio is a specialized software widely used for designing and conducting conjoint analysis and other market research studies, which means that organizations relying on this software for research data collection and analysis could be at risk. The vulnerability's exploitation could lead to full system compromise, data theft, manipulation of research data, or disruption of research operations.

For European organizations, the impact of this vulnerability could be severe, especially for market research firms, academic institutions, and enterprises that utilize Lighthouse Studio for consumer insights and decision-making processes. Successful exploitation could lead to unauthorized access to sensitive research data, intellectual property theft, and potential manipulation or destruction of data integrity, undermining the validity of research outcomes. Additionally, since the vulnerability allows remote code execution without authentication, attackers could leverage compromised systems as footholds within corporate networks, potentially leading to lateral movement and broader network compromise. This could result in operational downtime, reputational damage, and regulatory consequences under GDPR if personal data is involved. The critical severity and network accessibility mean that attackers could automate exploitation attempts, increasing the risk of widespread impact across organizations using vulnerable versions.

Immediate mitigation steps include upgrading Lighthouse Studio to version 9.16.14 or later, where the vulnerability is addressed. Since no patch links are currently provided, organizations should monitor Sawtooth Software's official channels for updates and apply patches as soon as they are released. In the interim, organizations should restrict network access to the ciwweb.pl component by implementing network segmentation and firewall rules to limit exposure to trusted IP addresses only. Employing Web Application Firewalls (WAFs) with custom rules to detect and block suspicious template injection patterns can provide additional protection. Regularly auditing and monitoring logs for unusual command execution or web requests targeting the ciwweb.pl endpoint is recommended to detect potential exploitation attempts early. Organizations should also review and harden their Perl web application configurations, disable unnecessary services, and ensure least privilege principles are applied to the application processes. Finally, conducting internal security awareness training to recognize and respond to suspicious activity related to this vulnerability will enhance overall defense.