CVE-2025-41762

MediumCVSS 6.2/10Last modified Jun 17, 2026

Description

An unauthenticated attacker can abuse the weak hash of the backup generated by the wwwdnload.cgi endpoint to gain unauthorized access to sensitive data, including password hashes and certificates.

Metrics

CVSS 3.1 6.2/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-328

Affected software

No affected versions have been published.

Timeline

Published: Mar 9, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-417636.5A low‑privileged remote attacker can directly interact with the wwwdnload.cgi endpoint to download any resource available to administrators,CVE-2025-417649.1Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupdate.cgi endpoint to upload and apply ar CVE-2025-417659.1Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupload.cgi endpoint to upload and apply ar CVE-2025-417668.8A low-privileged remote attacker can trigger a stack-based buffer overflow via a crafted HTTP POST request using the ubr-network method resu CVE-2025-417677.2A high-privileged remote attacker can fully compromise the device by abusing an update signature bypass vulnerability in the wwwupdate.cgi m CVE-2025-417685.5An high privileged remote attacker can inject arbitrary content into the custom CSS field on the affected devices due to improper neutraliza CVE-2025-417699.8The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. An unauthenticated re CVE-2025-41775.3The Flynax Bridge plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deleteUser() func CVE-2025-417707.5An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to inte CVE-2025-417714.3An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. CVE-2025-417727.5An unauthenticated remote attacker can obtain valid session tokens because they are exposed in plaintext within the URL parameters of the ww CVE-2025-41785.4A vulnerability was found in xiaowei1118 java_server up to 11a5bac8f4ba1c17e4bc1b27cad6d24868500e3a on Windows and classified as critical. T