CVE-2025-0674

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Multiple Elber products are affected by an authentication bypass vulnerability which allows unauthorized access to the password management functionality. Attackers can exploit this issue by manipulating the endpoint to overwrite any user's password within the system. This grants them unauthorized administrative access to protected areas of the application, compromising the device's system security.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-288

Affected software

No affected versions have been published.

Timeline

Published
Feb 7, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-06757.5Multiple Elber products suffer from an unauthenticated device configuration and client-side hidden functionality disclosure.CVE-2025-06768.6This vulnerability involves command injection in tcpdump within Moxa products, enabling an authenticated attacker with console access to expCVE-2025-06776.4A flaw was found in grub2. When performing a symlink lookup, the grub's UFS module checks the inode's data size to allocate the internal bufCVE-2025-06787.8A flaw was found in grub2. When reading data from a squash4 filesystem, grub's squash4 fs module uses user-controlled parameters from the fiCVE-2025-06794.3An issue has been discovered in GitLab CE/EE affecting all versions from 17.1 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. CVE-2025-06809.8Affected products contain a vulnerability in the device cloud rpc command handling process that could allow remote attackers to take controlCVE-2025-06816.2The Cloud MQTT service of the affected products supports wildcard topic subscription which could allow an attacker to obtain sensitive infCVE-2025-06828.8The ThemeREX Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.0 via the 'trx_sc_CVE-2025-06835.9In its default configuration, Contec Health CMS8000 Patient Monitor transmits plain-text patient data to a hard-coded public IP address wheCVE-2025-06846.4A flaw was found in grub2. When performing a symlink lookup from a reiserfs filesystem, grub's reiserfs fs module uses user-controlled paramCVE-2025-06856.4A flaw was found in grub2. When reading data from a jfs filesystem, grub's jfs filesystem module uses user-controlled parameters from the fiCVE-2025-06866.4A flaw was found in grub2. When performing a symlink lookup from a romfs filesystem, grub's romfs filesystem module uses user-controlled par