CVE-2025-41684

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing of user input in the Main Web Interface (endpoint tls_iotgen_setting).

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Jul 23, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-416856.5A low-privileged remote attacker can obtain the username of another registered Sunny Portal user by entering that user's email address.CVE-2025-416867.8A low-privileged local attacker can exploit improper permissions on nssm.exe to escalate their privileges and gain administrative access.CVE-2025-416879.8An unauthenticated remote attacker may use a stack based buffer overflow in the u-link Management API to gain full access on the affected de CVE-2025-416887.2A high privileged remote attacker can execute arbitrary OS commands using an undocumented method allowing to escape the implemented LUA sand CVE-2025-416897.5An unauthenticated remote attacker can get access without password protection to the affected device. This enables the unprotected read-only CVE-2025-41696.4The Posts per Cat [Unmaintained plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppc' shortcode in all ve CVE-2025-416907.4A low-privileged attacker in bluetooth range may be able to access the password of a higher-privilege user (Maintenance) by viewing the devi CVE-2025-416917.5An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending special CVE-2025-416926.8A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS d CVE-2025-416934.3A low privileged remote attacker can use the ssh feature to execute commands directly after login. The process stays open and uses resources CVE-2025-416946.5A low privileged remote attacker can run the webshell with an empty command containing whitespace. The server will then block until it recei CVE-2025-416957.1An XSS vulnerability in dyn_conn.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated