CVE-2025-25270

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurations.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-913

Affected software

VendorProductVersions
Phoenix ContactCHARX SEC-3150>= 0.0.0, < 1.7.3
Phoenix ContactCHARX SEC-3100>= 0.0.0, < 1.7.3
Phoenix ContactCHARX SEC-3050>= 0.0.0, < 1.7.3
Phoenix ContactCHARX SEC-3000>= 0.0.0, < 1.7.3

References

Timeline

Published
Jul 8, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-252718.8An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface.CVE-2025-252737.8Insufficient control flow management in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow aCVE-2025-252748.8Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to restrict command execution in archived channels, which alloCVE-2025-252766.5An unauthenticated attacker can hijack other users' devices and potentially control them.CVE-2025-252777.0in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through using incompatible tyCVE-2025-252787.0in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through race condition.CVE-2025-252797.5Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate board blocks when imporCVE-2025-25283.6Improper authorization in application password policy in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use CVE-2025-252805.3Buffer overflow vulnerability exists in FutureNet AS series (Industrial Routers) and FA series (Protocol Conversion Machine) provided by CenCVE-2025-252817.5An attacker may modify the URL to discover sensitive information about the target network.CVE-2025-252828.1RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine based on deep document understanding. An authenticated user can exploiCVE-2025-252837.5parse-duraton is software that allows users to convert a human readable duration to milliseconds. Versions prior to 2.1.3 are vulnerable to
CVE-2025-25270: Critical severity, CVSS 9.8 | Vulnix