CVE-2025-41683

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing of user input in the Main Web Interface (endpoint event_mail_test).

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Jul 23, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-416848.8An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing CVE-2025-416856.5A low-privileged remote attacker can obtain the username of another registered Sunny Portal user by entering that user's email address.CVE-2025-416867.8A low-privileged local attacker can exploit improper permissions on nssm.exe to escalate their privileges and gain administrative access.CVE-2025-416879.8An unauthenticated remote attacker may use a stack based buffer overflow in the u-link Management API to gain full access on the affected deCVE-2025-416887.2A high privileged remote attacker can execute arbitrary OS commands using an undocumented method allowing to escape the implemented LUA sandCVE-2025-416897.5An unauthenticated remote attacker can get access without password protection to the affected device. This enables the unprotected read-onlyCVE-2025-41696.4The Posts per Cat [Unmaintained plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppc' shortcode in all veCVE-2025-416907.4A low-privileged attacker in bluetooth range may be able to access the password of a higher-privilege user (Maintenance) by viewing the deviCVE-2025-416917.5An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specialCVE-2025-416926.8A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS dCVE-2025-416934.3A low privileged remote attacker can use the ssh feature to execute commands directly after login. The process stays open and uses resourcesCVE-2025-416946.5A low privileged remote attacker can run the webshell with an empty command containing whitespace. The server will then block until it recei