CVE-2025-65855

MediumCVSS 6.6/10Last modified Oct 13, 2026

Description

The OTA firmware update mechanism in Netun Solutions HelpFlash IoT (firmware v18_178_221102_ASCII_PRO_1R5_50) uses hard-coded WiFi credentials identical across all devices and does not authenticate update servers or validate firmware signatures. An attacker with brief physical access can activate OTA mode (8-second button press), create a malicious WiFi AP using the known credentials, and serve malicious firmware via unauthenticated HTTP to achieve arbitrary code execution on this safety-critical emergency signaling device.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-319 CWE-494 CWE-798

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://docs.espressif.com/projects/esp-idf/en/v4.3.2/Product
https://luismirandaacebedo.github.io/CVE-2025-65855/Third Party Advisory

Timeline

Published: Dec 17, 2025
Last modified: Oct 13, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-658569.8Authentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06 allows unauthenti CVE-2025-658577.5An issue was discovered in Xiongmai XM530 IP cameras on firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06. The GetStreamUri exposes RTS CVE-2025-658583.5A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username'CVE-2025-65867.2The Download Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the dpwap_plugin_loc CVE-2025-658657.5An integer overflow in eProsima Fast-DDS v3.3 allows attackers to cause a Denial of Service (DoS) via a crafted input.CVE-2025-658687.5XML external entity (XXE) injection in eyoucms v1.7.1 allows remote attackers to cause a denial of service via crafted body of a POST reques CVE-2025-65875.2System environment variables are recorded in Docker Desktop diagnostic logs, when using shell auto-completion. This leads to unintentional d CVE-2025-658759.8An arbitrary file upload vulnerability in the AddFont() function of FPDF v1.86 and earlier allows attackers to execute arbitrary code via up CVE-2025-658777.5Lvzhou CMS before commit c4ea0eb9cab5f6739b2c87e77d9ef304017ed615 (2025-09-22) is vulnerable to SQL injection via the 'title' parameter in c CVE-2025-658787.5The warehouse management system version 1.2 contains an arbitrary file read vulnerability. The endpoint `/file/showImageByPath` does not san CVE-2025-658798.1Warehouse Management System 1.2 contains an authenticated arbitrary file deletion vulnerability. The /goods/deleteGoods endpoint accepts a u CVE-2025-65886.1The FunnelCockpit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘error’ parameter in all versions up to, and