CVE-2025-54762

CriticalCVSS 9.3/10Last modified Oct 18, 2026

Description

SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated attacker to upload arbitrary files and execute OS commands with SYSTEM privileges.

Metrics

CVSS 4.0 9.3/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Aug 28, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-547637.2FutureNet MA and IP-K series provided by Century Systems Co., Ltd. contain an OS command Injection vulnerability. A user who logs in to the CVE-2025-547646.2Mbed TLS before 3.6.5 allows a local timing attack against certain RSA operations, and direct calls to mbedtls_mpi_mod_inv or mbedtls_mpi_gc CVE-2025-547655.3An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web applic CVE-2025-547665.3An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web applic CVE-2025-547676.5An authenticated, read-only user can kill any processes running on the Xormon Original virtual appliance as the lpar2rrd user.CVE-2025-547685.3An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web applic CVE-2025-547698.8An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in a location of their CVE-2025-54777.5Sony XAV-AX8500 Bluetooth L2CAP Protocol Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-a CVE-2025-547704.9A vulnerability has been identified in the GRUB2 bootloader's network module that poses an immediate Denial of Service (DoS) risk. This flaw CVE-2025-547714.9A use-after-free vulnerability has been identified in the GNU GRUB (Grand Unified Bootloader). The flaw occurs because the file-closing proc CVE-2025-547775.3Uncaught exception issue exists in Multiple products in bizhub series. If a malformed file is imported as an S/MIME Email certificate, it ma CVE-2025-547785.4A reflected cross-site scripting (xss) vulnerability exists in the existingUser functionality of MedDream PACS Premium 7.3.6.870. A speciall