CVE-2025-41753

CriticalCVSS 9.8/10Last modified Oct 14, 2026

Description

The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the device, which may lead to full system compromise.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 1, 2026
Last modified: Oct 14, 2026
NVD status: Awaiting Analysis

Related CVEs from 2025

CVE-2025-417546.5A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused API endpoint to read arbitrar CVE-2025-417556.5A low-privileged remote attacker can exploit the ubr-logread method in wwwubr.cgi to read arbitrary files on the system. The endpoint accept CVE-2025-417568.1A low-privileged remote attacker can exploit the ubr-editfile method in wwwubr.cgi, an undocumented and unused API endpoint to write arbitra CVE-2025-417578.8A low-privileged remote attacker can abuse the backup restore functionality of UBR (ubr-restore) which runs with elevated privileges and doe CVE-2025-417588.8A low-privileged remote attacker can exploit an arbitrary file write vulnerability in the wwupload.cgi endpoint. Due to path traversal this CVE-2025-417594.9An administrator may attempt to block all networks by specifying "\*" or "all" as the network identifier. However, these values are not supp CVE-2025-41769.8A vulnerability has been found in PHPGurukul Blood Bank & Donor Management System 2.4 and classified as critical. This vulnerability affects CVE-2025-417604.9An administrator may attempt to block all traffic by configuring a pass filter with an empty table. However, in UBR, an empty list does not CVE-2025-417617.8A low‑privileged local attacker who gains access to the UBR service account (e.g., via SSH) can escalate privileges to obtain full system ac CVE-2025-417626.2An unauthenticated attacker can abuse the weak hash of the backup generated by the wwwdnload.cgi endpoint to gain unauthorized access to sen CVE-2025-417636.5A low‑privileged remote attacker can directly interact with the wwwdnload.cgi endpoint to download any resource available to administrators,CVE-2025-417649.1Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupdate.cgi endpoint to upload and apply ar