← Back

CVE-2025-41720

nvd nist
Published: Oct 22, 2025Modified: Jun 17, 2026Deferred

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Exploitability: 2.8 / Impact: 1.4
Source: info@cert.vde.com (Secondary)

Description

A low privileged remote attacker can upload arbitrary data masked as a png file to the affected device using the webserver API because only the file extension is verified.

Related CWEs

CWE-646
Reliance on File Name or Extension of Externally-Supplied File
The product allows a file to be uploaded, but it relies on the file name or extension of the file to determine the appropriate behaviors. This could be used by attackers to cause the file to be misclassified and processed in a dangerous fashion.

References (1)

Source: info@cert.vde.com

Timeline

No history available yet.