CVE-2025-41761

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A low‑privileged local attacker who gains access to the UBR service account (e.g., via SSH) can escalate privileges to obtain full system access. This is due to the service account being permitted to execute certain binaries (e.g., tcpdump and ip) with sudo.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-88

Affected software

No affected versions have been published.

Timeline

Published: Mar 9, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-417626.2An unauthenticated attacker can abuse the weak hash of the backup generated by the wwwdnload.cgi endpoint to gain unauthorized access to sen CVE-2025-417636.5A low‑privileged remote attacker can directly interact with the wwwdnload.cgi endpoint to download any resource available to administrators,CVE-2025-417649.1Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupdate.cgi endpoint to upload and apply ar CVE-2025-417659.1Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupload.cgi endpoint to upload and apply ar CVE-2025-417668.8A low-privileged remote attacker can trigger a stack-based buffer overflow via a crafted HTTP POST request using the ubr-network method resu CVE-2025-417677.2A high-privileged remote attacker can fully compromise the device by abusing an update signature bypass vulnerability in the wwwupdate.cgi m CVE-2025-417685.5An high privileged remote attacker can inject arbitrary content into the custom CSS field on the affected devices due to improper neutraliza CVE-2025-417699.8The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. An unauthenticated re CVE-2025-41775.3The Flynax Bridge plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deleteUser() func CVE-2025-417707.5An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to inte CVE-2025-417714.3An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. CVE-2025-417727.5An unauthenticated remote attacker can obtain valid session tokens because they are exposed in plaintext within the URL parameters of the ww