CVE-2025-41378 | THREATINT

Description

The SSID field is not parsed correctly and can be used to inject commands into the hostpad.conf file. This can be exploited by an attacker to extend his knowledge of the system and compromise other devices. The information is filtered by the logs function of the web panel.

Reserved 2025-04-16 | Published 2025-05-23 | Updated 2025-05-27 | Assigner INCIBE

MEDIUM: 6.9CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Problem types

CWE-20 Improper Input Validation

Product status

Default status

unaffected

1.0.1

affected

Credits

Gabriel González García finder

References

www.incibe.es/...ities-intellian-technologies-iridium-certus

cve.org (CVE-2025-41378)

nvd.nist.gov (CVE-2025-41378)

Download JSON