First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-41645

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

An unauthenticated remote attacker could use a demo account of the portal to hijack devices that were created in that account by mistake.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
SMA	www.sunnyportal.com	< 20.02.2025

References

https://cert.vde.com/en/advisories/VDE-2025-010

Timeline

Published: May 13, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-416469.8An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. Thi CVE-2025-416475.5A local, low-privileged attacker can learn the password of the connected controller in PLC Designer V4 due to an incorrect implementation th CVE-2025-416489.8An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it possible to access and chan CVE-2025-416497.5An unauthenticated remote attacker can exploit insufficient input validation to write data beyond the bounds of a buffer, potentially leadin CVE-2025-416507.5An unauthenticated remote attacker can exploit input validation in cmd services of the devices, allowing them to disrupt system operations a CVE-2025-416519.8Due to missing authentication on a critical function of the devices an unauthenticated remote attacker can execute arbitrary commands, poten CVE-2025-416529.8The devices are vulnerable to an authentication bypass due to flaws in the authorization mechanism. An unauthenticated remote attacker could CVE-2025-416537.5An unauthenticated remote attacker can exploit a denial-of-service vulnerability in the device's web server functionality by sending a speci CVE-2025-416548.2An unauthenticated remote attacker can access information about running processes via the SNMP protocol. The amount of returned data can tri CVE-2025-416557.5An unauthenticated remote attacker can access a URL which causes the device to reboot.CVE-2025-4165610.0An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for th CVE-2025-416574.3Due to an undocumented active bluetooth stack on products delivered within the period 01.01.2024 to 09.05.2025 fingerprinting is possible by