CVE-2025-8449

MediumCVSS 4.1/10Last modified Jun 17, 2026

Description

CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service when an authenticated user sends a specially crafted request to a specific endpoint from within the BMS network.

Metrics

CVSS 4.0 4.1/10

CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Aug 20, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-84508.2Improper Access Control issue in the Workflow component of Fortra's FileCatalyst allows unauthenticated users to upload arbitrary files via CVE-2025-84516.4The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site CVE-2025-84524.3By using the "uscan" protocol provided by the eSCL specification, an attacker can discover the serial number of multi-function printers that CVE-2025-84536.7CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation and arbitrary code execution when a privil CVE-2025-84549.8It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of sc CVE-2025-84567.6Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kod8 Software Technologies Trad CVE-2025-84595.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Moni CVE-2025-84604.8Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Noti CVE-2025-84617.6Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Seres Software syWEB allows Ref CVE-2025-84626.4The RT Easy Builder – Advanced addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the social URL par CVE-2025-84635.3Authorization Bypass Through User-Controlled Key vulnerability in SecHard Information Technologies SecHard allows Forceful Browsing. This i CVE-2025-84645.3The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, a