CVE-2025-66620

HighCVSS 7.2/10Last modified Oct 7, 2026

Description

An unused webshell in MicroServer allows unlimited login attempts, with sudo rights on certain files and directories. An attacker with admin access to MicroServer can gain limited shell access, enabling persistence through reverse shells, and the ability to modify or remove data stored in the file system.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-553

Affected software

Vendor	Product	Versions
Columbia Weather Systems	MicroServer	< MS_4.1_14142

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-006-01.jsonThird Party Advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-26-006-01Third Party Advisory, US Government Resource

Timeline

Published: Jan 7, 2026
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-66621Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not c CVE-2025-666227.5matrix-sdk-base is the base component to build a Matrix client library. Versions 0.14.1 and prior are unable to handle responses that includ CVE-2025-666237.4Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. From 0.47.0 and prior CVE-2025-666247.5BACnet Protocol Stack library provides a BACnet application layer, network layer and media access (MAC) layer communications services. Prior CVE-2025-666254.9Umbraco is an ASP.NET CMS. Due to unsafe handling and deletion of temporary files in versions 10.0.0 through 13.12.0, during the dictionary CVE-2025-666267.5Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions 3.6.13 and below a CVE-2025-666277.8Wasmi is a WebAssembly interpreter focused on constrained and embedded systems. In versions 0.41.0, 0.41.1, 0.42.0 through 0.47.1, 0.50.0 th CVE-2025-666287.5ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image p CVE-2025-666294.3HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.4, some of HedgeDoc's OAuth2 endpoints for s CVE-2025-66637.8GStreamer H266 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to CVE-2025-666309.4Fiber is an Express inspired web framework written in Go. Before 2.52.11, on Go versions prior to 1.24, the underlying crypto/rand implement CVE-2025-666319.8CSLA .NET is a framework designed for the development of reusable, object-oriented business layers for applications. Versions 5.5.4 and belo