CVE-2025-41675

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to improper neutralization of special elements used in an OS command.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Jul 21, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-416764.9A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-sms action CVE-2025-416774.9A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-mail actio CVE-2025-416787.2A high privileged remote attacker can alter the configuration database via POST requests due to improper neutralization of special elements CVE-2025-416797.5An unauthenticated remote attacker could exploit a buffer overflow vulnerability in the device causing a denial of service that affects only CVE-2025-41686.4The Subpage List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'subpages' shortcode in all versions up CVE-2025-416814.8A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to creat CVE-2025-416828.8An authenticated, low-privileged attacker can obtain credentials stored on the charge controller including the manufacturer password.CVE-2025-416838.8An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing CVE-2025-416848.8An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing CVE-2025-416856.5A low-privileged remote attacker can obtain the username of another registered Sunny Portal user by entering that user's email address.CVE-2025-416867.8A low-privileged local attacker can exploit improper permissions on nssm.exe to escalate their privileges and gain administrative access.CVE-2025-416879.8An unauthenticated remote attacker may use a stack based buffer overflow in the u-link Management API to gain full access on the affected de