CVE-2025-44039

MediumCVSS 5.1/10Last modified Jun 17, 2026

Description

CP-XR-DE21-S -4G Router Firmware version 1.031.022 was discovered to contain insecure protections for its UART console. This vulnerability allows local attackers to connect to the UART port via a serial connection, read all boot sequence, and revealing internal system details and sensitive information without any authentication.

Metrics

CVSS 3.1 5.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Yashodhanvivek/CP-XR-DE21-S--4G-Router-Vulnerabilities/blob/main/input.mdExploit, Third Party Advisory

Timeline

Published: May 13, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-44049.1A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniquen CVE-2025-440407.2An issue in OrangeHRM v.5.7 allows an attacker to escalate privileges via UserService.php and the checkForOldHash function. Authentication d CVE-2025-440435.4Keyoti SearchUnit prior to 9.0.0. is vulnerable to Server-Side Request Forgery (SSRF) in /Keyoti_SearchEngine_Web_Common/SearchService.svc/G CVE-2025-440447.5Keyoti SearchUnit prior to 9.0.0. is vulnerable to XML External Entity (XXE). An attacker who can force a vulnerable SearchUnit host into pa CVE-2025-44055.4The Hot Random Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in all versions up to, and i CVE-2025-44065.4The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including CVE-2025-44076.7Insufficient Session Expiration vulnerability in ABB Lite Panel Pro.This issue affects Lite Panel Pro: through 1.0.1.CVE-2025-440719.8SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component phomebak.php. This vulnerability allows CVE-2025-440729.8SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_manager.php.CVE-2025-440739.8SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_comment_news.php.CVE-2025-440749.8SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_topic.php.CVE-2025-440839.8An issue in D-Link DI-8100 16.07.26A1 allows a remote attacker to bypass administrator login authentication