CVE-2025-49002

DataEase, an open-source business intelligence and data visualization tool, shipped an incomplete fix for CVE-2025-32966: the patch blocks H2 database statements containing the keywords INIT and RUNSCRIPT, but the check is case-sensitive, so attackers can submit those keywords in mixed or lowercase form to bypass it. By doing so in a crafted unauthenticated network request (for example via H2 JDBC connection parameters or the H2 SQL interface), an attacker re-opens the original CVE-2025-32966 attack path. The vector requires no privileges or user interaction, though CVSS 4.0 rates attack complexity as high; a successful bypass yields high confidentiality, integrity and availability impact, consistent with arbitrary SQL execution and likely remote code execution. All DataEase versions prior to 2.10.10 are affected, the flaw is fixed in v2.10.10, and no workarounds are available. No confirmed in-the-wild exploitation is reported and it is not in CISA KEV, but two public advisories/PoC references exist and EPSS assigns a 50.3% probability of exploitation within 30 days (99th percentile), making near-term exploitation plausible.

What to do: Upgrade to DataEase 2.10.10 or later immediately, as there are no workarounds; until upgraded, restrict network access to the DataEase instance and its H2/SQL endpoints. Given the ~50% EPSS score and public PoCs, review logs for anomalous SQL or H2 statements (including mixed-case RUNSCRIPT/INIT usage) that could indicate exploitation.