CVE-2025-24341

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability in the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to induce a Denial-of-Service (DoS) condition on the device via multiple crafted HTTP requests. In the worst case, a full power cycle is needed to regain control of the device.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published
Apr 30, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-243425.3A vulnerability in the login functionality of the web application of ctrlX OS allows a remote unauthenticated attacker to guess valid usernaCVE-2025-243435.4A vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) atCVE-2025-243446.3A vulnerability in the error notification messages of the web application of ctrlX OS allows a remote unauthenticated attacker to inject arbCVE-2025-243456.3A vulnerability in the “Hosts” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attacker to mCVE-2025-243467.5A vulnerability in the “Proxy” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) attacker to maCVE-2025-243476.5A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) CVE-2025-243485.4A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) CVE-2025-243497.1A vulnerability in the “Network Interfaces” functionality of the web application of ctrlX OS allows a remote authenticated (lowprivileged) aCVE-2025-243507.1A vulnerability in the “Certificates and Keys” functionality of the web application of ctrlX OS allows a remote authenticated (low-privilegeCVE-2025-243518.8A vulnerability in the “Remote Logging” functionality of the web application of ctrlX OS allows a remote authenticated (low-privileged) attaCVE-2025-243534.3Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.2.0, when sharing an item, a typical usCVE-2025-243545.3imgproxy is server for resizing, processing, and converting images. Imgproxy does not block the 0.0.0.0 address, even with IMGPROXY_ALLOW_LO