First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2025-57175

MediumCVSS 6.8/10Last modified Jul 25, 2026

Description

Siklu EtherHaul 8010 siklu-uimage-nxp-enc-10_6_2-18707-ea552dc00b devices have a static root password.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Siklu	EtherHaul 8010	siklu-uimage-nxp-enc-10_6_2-18707-ea552dc00b

References

https://semaja2.net/2025/04/30/siklu-eh-firmware-decryption/Third Party Advisory

Timeline

Published: Apr 8, 2026
Last modified: Jul 25, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-571766.5On Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpiped service on TCP po CVE-2025-57186.8The ACAP Application framework could allow privilege escalation through a symlink attack. This vulnerability can only be exploited if the Ax CVE-2025-57195.1The wallet has an authentication bypass vulnerability that allows access to specific pages.CVE-2025-571976.0In the Payeer Android application 2.5.0, an improper access control vulnerability exists in the authentication flow for the PIN change featu CVE-2025-571988.8AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability i CVE-2025-571998.8AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability i CVE-2025-57206.4The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘author’ parameter in all ver CVE-2025-572006.5AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability i CVE-2025-572018.8AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability i CVE-2025-572026.1A stored cross-site scripting (XSS) vulnerability in the PwdGrp.cgi endpoint of AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1 CVE-2025-572034.8MagicProject AI version 9.1 is affected by a Cross-Site Scripting (XSS) vulnerability within the chatbot generation feature available to aut CVE-2025-572045.4Stocky POS with Inventory Management & HRM (ui-lib) version 5.0 is affected by a Stored Cross-Site Scripting (XSS) vulnerability within the

CVE-2025-57175: Medium severity, CVSS 6.8 | Vulnix