CVE-2025-48392

HighCVSS 7.5/10Last modified Sep 26, 2026

Description

A vulnerability in Apache IoTDB.

This issue affects Apache IoTDB: from 1.3.3 through 1.3.4, from 2.0.1-beta through 2.0.4.

Users are recommended to upgrade to version 2.0.5, which fixes the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published
Sep 24, 2025
Last modified
Sep 26, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-483935.7The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacCVE-2025-483944.7An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limitedCVE-2025-483954.7An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limitedCVE-2025-483968.3Arbitrary code execution is possible due to improper validation of the file upload functionality in Eaton BLSS. This security issue has beenCVE-2025-483977.1The privileged user could log in without sufficient credentials after enabling an application protocol. This security issue has been fixed iCVE-2025-48407.5The inprosysmedia-likes-dislikes-post WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a CVE-2025-48419.8A vulnerability was found in D-Link DCS-932L 2.18.01 and classified as critical. Affected by this issue is the function sub_404780 of the fiCVE-2025-484137.7The `/etc/passwd` and `/etc/shadow` files reveal hard-coded password hashes for the operating system "root" user. The credentials are shippeCVE-2025-484146.5There are several scripts in the web interface that are accessible via undocumented hard-coded credentials. The scripts provide access to adCVE-2025-484156.2A USB backdoor feature can be triggered by attaching a USB drive that contains specially crafted "salia.ini" files. The .ini file can contaiCVE-2025-484168.1An OpenSSH daemon listens on TCP port 22. There is a hard-coded entry in the "/etc/shadow" file in the firmware image for the "root" user. HCVE-2025-484176.5The certificate and private key used for providing transport layer security for connections to the web interface (TCP port 443) is hard-code
CVE-2025-48392: High severity, CVSS 7.5 | Vulnix