CVE-2025-41759

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

An administrator may attempt to block all networks by specifying "\*" or "all" as the network identifier. However, these values are not supported and do not trigger any validation error. Instead, they are silently interpreted as network 0 which results in no networks being blocked at all.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-636

Affected software

No affected versions have been published.

Timeline

Published: Mar 9, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-41769.8A vulnerability has been found in PHPGurukul Blood Bank & Donor Management System 2.4 and classified as critical. This vulnerability affects CVE-2025-417604.9An administrator may attempt to block all traffic by configuring a pass filter with an empty table. However, in UBR, an empty list does not CVE-2025-417617.8A low‑privileged local attacker who gains access to the UBR service account (e.g., via SSH) can escalate privileges to obtain full system ac CVE-2025-417626.2An unauthenticated attacker can abuse the weak hash of the backup generated by the wwwdnload.cgi endpoint to gain unauthorized access to sen CVE-2025-417636.5A low‑privileged remote attacker can directly interact with the wwwdnload.cgi endpoint to download any resource available to administrators,CVE-2025-417649.1Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupdate.cgi endpoint to upload and apply ar CVE-2025-417659.1Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupload.cgi endpoint to upload and apply ar CVE-2025-417668.8A low-privileged remote attacker can trigger a stack-based buffer overflow via a crafted HTTP POST request using the ubr-network method resu CVE-2025-417677.2A high-privileged remote attacker can fully compromise the device by abusing an update signature bypass vulnerability in the wwwupdate.cgi m CVE-2025-417685.5An high privileged remote attacker can inject arbitrary content into the custom CSS field on the affected devices due to improper neutraliza CVE-2025-417699.8The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. An unauthenticated re CVE-2025-41775.3The Flynax Bridge plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deleteUser() func