CVE-2025-2771

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

BEC Technologies Multiple Routers Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of BEC Technologies routers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the web-based user interface. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-25894.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Apr 23, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-277105.5Untrusted pointer dereference for some Intel(R) QAT Windows software before version 2.6.0. within Ring 3: User Applications may allow an inf CVE-2025-277116.7Incorrect default permissions for some Intel(R) One Boot Flash Update (Intel(R) OFU) software before version 14.1.31 within Ring 3: User App CVE-2025-277125.7Improper neutralization for some Intel(R) Neural Compressor software before version v3.4 within Ring 3: User Applications may allow an escal CVE-2025-277137.8Out-of-bounds write for some Intel(R) QAT Windows software before version 2.6.0. within Ring 3: User Applications may allow an escalation of CVE-2025-277146.3An attacker could exploit this vulnerability by uploading arbitrary files via the a specific endpoint, leading to unauthorized remote code CVE-2025-277152.7Mattermost versions 9.11.x <= 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins CVE-2025-277166.5Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file/folder listing process of the USB st CVE-2025-277176.7Uncontrolled search path for some Intel(R) Graphics Driver software may allow an authenticated user to potentially enable escalation of priv CVE-2025-277188.8Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in the file upload process of the USB storage fi CVE-2025-277195.3Unauthenticated attackers can query an API endpoint and get device details.CVE-2025-27726.5BEC Technologies Multiple Routers Insufficiently Protected Credentials Information Disclosure Vulnerability. This vulnerability allows netwo CVE-2025-277207.4The Pixmeo Osirix MD Web Portal sends credential information without encryption, which could allow an attacker to steal credentials.