CVE-2025-61941

HighCVSS 8.6/10Last modified Oct 8, 2026

Description

A path traversal issue exists in WXR9300BE6P series firmware versions prior to Ver.1.10. Arbitrary file may be altered by an administrative user who logs in to the affected product. Moreover, arbitrary OS command may be executed via some file alteration.

Metrics

CVSS 4.0 8.6/10CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Oct 15, 2025
Last modified
Oct 8, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-619437.8The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Standard User) to tamper with queries in CaptCVE-2025-619448.0Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a CVE-2025-619459.8Radiometrics VizAir is vulnerable to any remote attacker via access to the admin panel of the VizAir system without authentication. Once insCVE-2025-619494.8LogStare Collector contains a stored cross-site scripting vulnerability in UserManagement. If crafted user information is stored, an arbitraCVE-2025-61954.3GitLab has remediated an issue in GitLab EE affecting all versions from 13.7 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that CVE-2025-619505.3In GroupSession, a Circular notice can be created with its memo field non-editable, but the authorization check is improperly implemented. WCVE-2025-619517.5Undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  This issue may occur when a Datagram Transport Layer SCVE-2025-619527.1An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker coCVE-2025-619558.8A vulnerability exists in F5OS-A and F5OS-C systems that may allow an authenticated attacker with local access to escalate their privileges.CVE-2025-619569.8Radiometrics VizAir is vulnerable to a lack of authentication mechanisms for critical functions, such as admin access and API requests. AttaCVE-2025-619588.7A vulnerability exists in the iHealth command that may allow an authenticated attacker with at least a resource administrator role to bypassCVE-2025-619595.3Prior to September 19, 2025, the Hospital Manager Backend Services returned verbose ASP.NET error pages for invalid WebResource.axd requests