The vulnerability identified as CVE-2025-6175 in DECE Software Geodi is due to improper neutralization of CRLF sequences (CWE-93), which enables HTTP request splitting attacks. This issue affects versions before GEODI Setup 9.0.146. The CVSS 3.1 base score is 7.2, indicating a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with a scope change. The vulnerability allows an attacker to inject CRLF sequences into HTTP requests, potentially manipulating HTTP headers and responses.

Successful exploitation of this vulnerability can lead to HTTP request splitting, which may allow attackers to perform web cache poisoning, cross-site scripting, or other HTTP header injection attacks. The confidentiality and integrity of the affected system can be compromised, but availability is not impacted. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 9.0.146, upgrading to version 9.0.146 or later is likely recommended once an official fix is released. Until then, monitor vendor communications for patches or temporary mitigations. No cloud service remediation applies as this is an on-premises product.