CVE-2025-41674

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special elements used in an OS command.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
MB connect linembNET.mini>= 0.0.0, < 2.3.3
HelmholzREX 100>= 0.0.0, < 2.3.3

References

Timeline

Published
Jul 21, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-416757.2A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to impCVE-2025-416764.9A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-sms actionCVE-2025-416774.9A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-mail actioCVE-2025-416787.2A high privileged remote attacker can alter the configuration database via POST requests due to improper neutralization of special elements CVE-2025-416797.5An unauthenticated remote attacker could exploit a buffer overflow vulnerability in the device causing a denial of service that affects onlyCVE-2025-41686.4The Subpage List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'subpages' shortcode in all versions up CVE-2025-416814.8A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to creatCVE-2025-416828.8An authenticated, low-privileged attacker can obtain credentials stored on the charge controller including the manufacturer password.CVE-2025-416838.8An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing CVE-2025-416848.8An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing CVE-2025-416856.5A low-privileged remote attacker can obtain the username of another registered Sunny Portal user by entering that user's email address.CVE-2025-416867.8A low-privileged local attacker can exploit improper permissions on nssm.exe to escalate their privileges and gain administrative access.
CVE-2025-41674: High severity, CVSS 7.2 | Vulnix