CVE-2025-53520

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The affected product allows firmware updates to be downloaded from EG4's website, transferred via USB dongles, or installed through EG4's Monitoring Center (remote, cloud-connected interface) or via a serial connection, and can install these files without integrity checks. The TTComp archive format used for the firmware is unencrypted and can be unpacked and altered without detection.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-494

Affected software

VendorProductVersions
EG4 ElectronicsEG4 12kPVall versions
EG4 ElectronicsEG4 18kPVall versions
EG4 ElectronicsEG4 Flex 21all versions
EG4 ElectronicsEG4 Flex 18all versions
EG4 ElectronicsEG4 6000XPall versions
EG4 ElectronicsEG4 12000XPall versions
EG4 ElectronicsEG4 GridBossall versions

References

Timeline

Published
Aug 8, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-535219.8When a BIG-IP APM access policy is configured on a virtual server, specific malicious traffic can lead to Remote Code Execution (RCE).   NoCVE-2025-535226.9Movable Type contains an issue with use of less trusted source. If exploited, tampered email to reset a password may be sent by a remote unaCVE-2025-535234.8Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, anCVE-2025-535247.8Fuji Electric Monitouch V-SFT-6 is vulnerable to an out-of-bounds write while processing a specially crafted project file, which may allow CVE-2025-535256.1WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the profile_familCVE-2025-535266.1WeGIA is a web manager for charitable institutions. An XSS Injection vulnerability was identified in novo_memorando.php. After the memo was CVE-2025-535279.8WeGIA is a web manager for charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in the almox parameter of CVE-2025-535287.6Cadwyn creates production-ready community-driven modern Stripe-like API versioning in FastAPI. In versions before 5.4.3, the version parametCVE-2025-535299.8WeGIA is a web manager for charitable institutions. An SQL Injection vulnerability was identified in the /html/funcionario/profile_funcionarCVE-2025-53537.8A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt stored SQL credentialCVE-2025-535307.5WeGIA is a web manager for charitable institutions. The Wegia server has a vulnerability that allows excessively long HTTP GET requests to aCVE-2025-535317.5WeGIA is a web manager for charitable institutions. The Wegia server has a vulnerability that allows excessively long HTTP GET requests to a
CVE-2025-53520: High severity, CVSS 8.8 | Vulnix