Home

Description

An unauthenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of Cross-Site Request Forgery (CSRF) protection.

PUBLISHED Reserved 2025-04-16 | Published 2025-06-11 | Updated 2025-07-24 | Assigner CERTVDE




HIGH: 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Problem types

CWE-352 Cross-Site Request Forgery (CSRF)

Product status

Default status
unaffected

Any version before V1.49
affected

Default status
unaffected

Any version before V1.62
affected

Default status
unaffected

Any version before V1.62
affected

Credits

ONEKEY Research Labs finder

References

certvde.com/en/advisories/VDE-2025-052

cve.org (CVE-2025-41661)

nvd.nist.gov (CVE-2025-41661)

Download JSON