CVE-2025-41765

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupload.cgi endpoint to upload and apply arbitrary data. This includes, but is not limited to, contact images, HTTPS certificates, system backups for restoration, server peer configurations, and BACnet/SC server certificates and keys.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Mar 9, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-417668.8A low-privileged remote attacker can trigger a stack-based buffer overflow via a crafted HTTP POST request using the ubr-network method resu CVE-2025-417677.2A high-privileged remote attacker can fully compromise the device by abusing an update signature bypass vulnerability in the wwwupdate.cgi m CVE-2025-417685.5An high privileged remote attacker can inject arbitrary content into the custom CSS field on the affected devices due to improper neutraliza CVE-2025-417699.8The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. An unauthenticated re CVE-2025-41775.3The Flynax Bridge plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deleteUser() func CVE-2025-417707.5An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to inte CVE-2025-417714.3An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. CVE-2025-417727.5An unauthenticated remote attacker can obtain valid session tokens because they are exposed in plaintext within the URL parameters of the ww CVE-2025-41785.4A vulnerability was found in xiaowei1118 java_server up to 11a5bac8f4ba1c17e4bc1b27cad6d24868500e3a on Windows and classified as critical. T CVE-2025-41797.3The Flynax Bridge plugin for WordPress is vulnerable to limited Privilege Escalation due to a missing capability check on the registerUser()CVE-2025-41809.8A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. Affected is an unknown function of the component TR CVE-2025-41819.8A vulnerability was found in PCMan FTP Server 2.0.7. It has been declared as critical. Affected by this vulnerability is an unknown function