CVE-2025-1424

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

A privilege escalation vulnerability in PocketBook InkPad Color 3 allows attackers to escalate to root privileges if they gain physical access to the device. This issue affects InkPad Color 3 in version U743k3.6.8.3671.

Metrics

CVSS 4.0 8.6/10

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published: Mar 4, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-142426.5A flaw was found in vsftpd. This vulnerability allows a denial of service (DoS) via an integer overflow in the ls command parameter parsing,CVE-2025-142435.3A flaw was found in the OpenShift Mirror Registry. This vulnerability allows an unauthenticated, remote attacker to enumerate valid username CVE-2025-142444.8A flaw has been found in GreenCMS 2.3.0603. Affected by this issue is some unknown functionality of the file /Admin/Controller/CustomControl CVE-2025-142459.8A vulnerability has been found in IdeaCMS up to 1.8. This affects the function whereRaw of the file app/common/logic/index/Coupon.php. Such CVE-2025-142469.8A vulnerability was found in code-projects Simple Shopping Cart 1.0. This vulnerability affects unknown code of the file /Customers/settings CVE-2025-142479.8A vulnerability was determined in code-projects Simple Shopping Cart 1.0. This issue affects some unknown processing of the file /Admin/addi CVE-2025-142489.8A vulnerability was identified in code-projects Simple Shopping Cart 1.0. Impacted is an unknown function of the file /adminlogin.php. The m CVE-2025-142499.8A security flaw has been discovered in code-projects Online Ordering System 1.0. The affected element is an unknown function of the file /us CVE-2025-14254.7A Sudo privilege misconfiguration vulnerability in PocketBook InkPad Color 3 on Linux, ARM allows attackers to read file contents on the dev CVE-2025-142509.8A weakness has been identified in code-projects Online Ordering System 1.0. The impacted element is an unknown function of the file /user_co CVE-2025-142519.8A security vulnerability has been detected in code-projects Online Ordering System 1.0. This affects an unknown function of the file /admin/CVE-2025-142527.8An Improper Access Control vulnerability in Advantech SUSI driver (susi.sys) allows attackers to read/write arbitrary memory, I/O ports, and