Home

Description

A low privileged remote attacker can upload arbitrary data masked as a png file to the affected device using the webserver API because only the file extension is verified.

PUBLISHED Reserved 2025-04-16 | Published 2025-10-22 | Updated 2025-10-22 | Assigner CERTVDE




MEDIUM: 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Problem types

CWE-646:Reliance on File Name or Extension of Externally-Supplied File

Product status

Default status
unaffected

0.0.0 (semver) before Firmware v3.2.0
affected

Default status
unaffected

0.0.0 (semver) before Firmware v3.2.0
affected

Default status
unaffected

0.0.0 (semver) before Firmware v3.2.0
affected

Default status
unaffected

0.0 (semver) before Firmware v6.0
affected

Default status
unaffected

0.0 (semver) before Firmware v6.0
affected

Default status
unaffected

0.0 (semver) before Firmware v6.0
affected

Credits

Damian Pfammatter, Daniel Hulliger from Cyber-Defence Campus armasuisse finder

References

sauter.csaf-tp.certvde.com/...f/white/2025/vde-2025-060.json

cve.org (CVE-2025-41720)

nvd.nist.gov (CVE-2025-41720)

Download JSON

Data based on CVE®. Copyright © 1999-2025, The MITRE Corporation. All rights reserved.