Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317863 - https://vuldb.com/?ctiid.317863 - https://vuldb.com/?submit.623550 - https://github.com/ashin9/CVE/issues/1 - https://www.campcodes.com/
CVE ID: CVE-2025-8275 State: PUBLISHED Published: 2025-07-28T12:02:05.803Z Last Updated: 2025-07-28T13:28:40.227Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R) Vendors: bsc Products: Peru Cocktails App Problem Types: CWE-926 Description: A vulnerability, which was classified as problematic, has been found in bsc Peru Cocktails App 1.0.0 on Android. Affected by this issue is some unknown functionality of the file AndroidManifest.xml of the component bsc.devy.peru_cocktails. The manipulation leads to improper export of android application components. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and
ion components. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.317864 - https://vuldb.com/?ctiid.317864 - https://vuldb.com/?submit.623582 - https://github.com/KMov-g/androidapps/blob/main/bsc.devy.peru_cocktails.md
CVE ID: CVE-2025-8276 State: PUBLISHED Published: 2025-09-16T14:00:24.663Z Last Updated: 2025-10-08T15:55:02.616Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Patika Global Technologies Products: HumanSuite Problem Types: CWE-79, CWE-116, CWE-74 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Encoding or Escaping of Output, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Patika Global Technologies HumanSuite allows Cross-Site Scripting (XSS), Phishing.This issue affects HumanSuite: before 53.21.0. Additional Analyst Notes:
ite allows Cross-Site Scripting (XSS), Phishing.This issue affects HumanSuite: before 53.21.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0257
CVE ID: CVE-2025-8277 State: PUBLISHED Published: 2025-09-09T11:55:39.036Z Last Updated: 2025-11-21T07:29:28.733Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 Problem Types: CWE-401 Description: A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the clie
ory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-8277 - https://bugzilla.redhat.com/show_bug.cgi?id=2383888
CVE ID: CVE-2025-8279 State: PUBLISHED Published: 2025-07-28T14:04:28.764Z Last Updated: 2025-07-28T14:23:37.024Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Language Server Problem Types: CWE-306 Description: Insufficient input validation within GitLab Language Server 7.6.0 and later before 7.30.0 allows arbitrary GraphQL query execution Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/538205
CVE ID: CVE-2025-8280 State: PUBLISHED Published: 2025-09-12T06:00:06.157Z Last Updated: 2025-09-12T16:22:30.609Z Vendors: Unknown Products: Contact Form 7 reCAPTCHA Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Contact Form 7 reCAPTCHA WordPress plugin through 1.2.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f8370026-6293-4814-961f-c254ee8e844d/
CVE ID: CVE-2025-8281 State: PUBLISHED Published: 2025-08-22T06:00:03.699Z Last Updated: 2025-08-22T14:41:00.516Z Vendors: Unknown Products: WP Talroo Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Talroo WordPress plugin through 2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin and unauthenticated users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/36b9305e-e086-4edb-bff9-d181ea316389/
CVE ID: CVE-2025-8282 State: PUBLISHED Published: 2025-09-23T06:00:06.866Z Last Updated: 2025-11-13T20:56:24.562Z Vendors: Unknown Products: SureForms Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The SureForms WordPress plugin before 1.9.1 does not sanitise and escape some parameters when outputing them in the page, which could allow admin and above users to perform Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/62680106-1313-4ef0-80a5-33e93b4221a1/
CVE ID: CVE-2025-8283 State: PUBLISHED Published: 2025-07-28T18:16:07.853Z Last Updated: 2025-11-07T21:38:20.081Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 Problem Types: CWE-15 Description: A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may return external servers if a valid A/AAAA record is sent as a response. When creating a container with a given name, this name will be used as the hostname for the contai
s sent as a response. When creating a container with a given name, this name will be used as the hostname for the container itself, as the podman's search domain is not added anymore the container is using the host's resolv.conf, and the DNS resolver will try to look into the search domains contained on it. If one of the domains contain a name with the same hostname as the running container, the connection will forward to unexpected external servers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-8283 - https://bugzilla.redhat.com/show_bug.cgi?id=2383941 - https://github.com/advisories/GHSA-rpcf-rmh6-42xr - https://github.com/
://bugzilla.redhat.com/show_bug.cgi?id=2383941 - https://github.com/advisories/GHSA-rpcf-rmh6-42xr - https://github.com/containers/netavark/releases/tag/v1.15.1
CVE ID: CVE-2025-8284 State: PUBLISHED Published: 2025-08-08T16:27:14.031Z Last Updated: 2025-08-08T19:14:38.595Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Packet Power Products: EMX, EG Problem Types: CWE-306 Description: By default, the Packet Power Monitoring and Control Web Interface do not enforce authentication mechanisms. This vulnerability could allow unauthorized users to access and manipulate monitoring and control functions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-05
CVE ID: CVE-2025-8285 State: PUBLISHED Published: 2025-08-11T18:57:07.701Z Last Updated: 2025-08-11T19:41:20.762Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N) Vendors: Mattermost Products: Mattermost Confluence Plugin Problem Types: CWE-862 Description: Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to create channel subscription without proper access to the channel via API call to the create channel subscription endpoint. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-8286 State: PUBLISHED Published: 2025-07-31T19:23:37.557Z Last Updated: 2025-08-15T20:24:46.530Z Vendors: Güralp Systems Products: Güralp FMUS Series, MIN Series Devices Problem Types: CWE-306 Description: The affected products expose an unauthenticated Telnet-based command line interface that could allow an attacker to modify hardware configurations, manipulate data, or factory reset the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-25-212-01
CVE ID: CVE-2025-8289 State: PUBLISHED Published: 2025-08-20T01:44:36.231Z Last Updated: 2025-08-20T15:15:22.608Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: themeisle Products: Redirection for Contact Form 7 Problem Types: CWE-502 Description: The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the delete_associated_files function. This makes it possible for unauthenticated attackers to inject a PHP Object. This vulnerability may be exploited by unauthenticated attackers when a form is present on the site with a file upload actio
vulnerability may be exploited by unauthenticated attackers when a form is present on the site with a file upload action, and doesn't affect sites with PHP version > 8. This vulnerability also requires the 'Redirection For Contact Form 7 Extension - Create Post' extension to be installed and activated in order to be exploited. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive da
ed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. We confirmed there is a usable gadget in Contact Form 7 plugin that makes arbitrary file deletion possible when installed with this plugin. Given Contact Form 7 is a requirement of this plugin, it is likely that any site with this plugin and the 'Redirection For Contact Form 7 Extension - Create Post' extension enabled is vulnerable to arbitrary file deletion. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c7909b75-8087-4d38-8325-c619bf84d997?s
richment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c7909b75-8087-4d38-8325-c619bf84d997?source=cve - https://plugins.trac.wordpress.org/browser/wpcf7-redirect/tags/3.2.4/classes/class-wpcf7r-save-files.php#L80
CVE ID: CVE-2025-8290 State: PUBLISHED Published: 2025-08-29T04:25:29.875Z Last Updated: 2025-08-29T11:58:50.140Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: weblineindia Products: List Subpages Problem Types: CWE-79 Description: The List Subpages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Note
ject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b5a24a4a-654c-487e-af68-13db63961896?source=cve - https://wordpress.org/plugins/list-sub-pages/#developers
CVE ID: CVE-2025-8291 State: PUBLISHED Published: 2025-10-07T18:10:05.908Z Last Updated: 2025-10-29T15:15:27.172Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Python Software Foundation Products: CPython Description: The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations. Remediation maintains this behavior, but ch
d differently by the 'zipfile' module compared to other ZIP implementations. Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the expected value. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/python/cpython/pull/139702 - https://mail.python.org/archives/list/security-announce@python.org/thread/QECOPWMTH4VPPJAXAH2BGTA4XADOP62G/ - https://github.com/python/cpython/issues/139700 - https://github.com/python/cpython/commit/162997bb70e067668c039700141770687bc8f267 - https://github.com/python/cpython/commit/333d4a6f4967d3ace91492a39ededbcf3faa76a6 - https://github.com/python/cpython/commit/1d29af
hub.com/python/cpython/commit/333d4a6f4967d3ace91492a39ededbcf3faa76a6 - https://github.com/python/cpython/commit/1d29afb0d6218aa8fb5e1e4a6133a4778d89bb46 - https://github.com/python/cpython/commit/76437ac248ad8ca44e9bf697b02b1e2241df2196 - https://github.com/python/cpython/commit/8392b2f0d35678407d9ce7d95655a5b77de161b4 - https://github.com/python/cpython/commit/bca11ae7d575d87ed93f5dd6a313be6246e3e388 - https://github.com/python/cpython/commit/d11e69d6203080e3ec450446bfed0516727b85c3
CVE ID: CVE-2025-8292 State: PUBLISHED Published: 2025-07-30T01:18:27.241Z Last Updated: 2025-07-31T03:55:56.711Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in Media Stream in Google Chrome prior to 138.0.7204.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_29.html - https://issues.chromium.org/issues/426054987
CVE ID: CVE-2025-8293 State: PUBLISHED Published: 2025-08-16T03:38:53.213Z Last Updated: 2025-08-18T13:17:07.526Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: Theerawat Patthawee Products: Intl DateTime Calendar Problem Types: CWE-79 Description: The Intl DateTime Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘date’ parameter in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dc333949-de1e-493a-badd-3be1c9060503?source=cve - https://wordpress.org/plugins/intl-datetime-calendar/
CVE ID: CVE-2025-8294 State: PUBLISHED Published: 2025-08-05T07:24:16.380Z Last Updated: 2025-08-05T14:43:11.464Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: anatolyk Products: Download Counter Problem Types: CWE-79 Description: The Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes
ect arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9fcf7936-8a28-45b9-a9dc-fd7257a83a84?source=cve - https://wordpress.org/plugins/download-counter/#developers - https://plugins.trac.wordpress.org/changeset/3338968
CVE ID: CVE-2025-8295 State: PUBLISHED Published: 2025-08-05T07:24:15.940Z Last Updated: 2025-08-05T14:52:30.979Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: emarket-design Products: Employee Directory – Staff Listing & Team Directory Plugin for WordPress Problem Types: CWE-79 Description: The Employee Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will e
r authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6d06d721-ab48-43ae-81d6-bd0b3177a7bf?source=cve - https://wordpress.org/plugins/employee-directory/#developers - https://plugins.trac.wordpress.org/browser/employee-directory/tags/4.5.1/includes/emd-form-builder-lite/emd-form-frontend.php - https://plugins.trac.wordpress.org/changeset/3336753/
CVE ID: CVE-2025-8296 State: PUBLISHED Published: 2025-08-12T14:33:47.566Z Last Updated: 2025-08-13T15:03:48.706Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Avalanche Problem Types: CWE-89 Description: SQL injection in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to execute arbitrary SQL queries. In certain conditions, this can also lead to remote code execution Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-CVE-2025-8296-CVE-2025-8297?language=en_US
CVE ID: CVE-2025-8297 State: PUBLISHED Published: 2025-08-12T14:37:23.954Z Last Updated: 2025-08-13T15:03:49.950Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Avalanche Problem Types: CWE-434 Description: Incomplete restriction of configuration in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to achieve remote code execution Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Avalanche-CVE-2025-8296-CVE-2025-8297?language=en_US
CVE ID: CVE-2025-8298 State: PUBLISHED Published: 2025-09-02T20:02:30.551Z Last Updated: 2025-09-03T14:50:16.191Z Severity: LOW (CVSS 3.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Realtek Products: RTL8811AU Problem Types: CWE-125 Description: Realtek RTL8811AU rtwlanu.sys N6CQueryInformationHandleCustomized11nOids Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of Realtek RTL8811AU drivers. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the N6CQueryInf
ileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the N6CQueryInformationHandleCustomized11nOids function. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the kernel. Was ZDI-CAN-25864. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-881/
CVE ID: CVE-2025-8299 State: PUBLISHED Published: 2025-09-02T20:02:34.610Z Last Updated: 2025-09-03T14:33:20.565Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Realtek Products: rtl81xx SDK Problem Types: CWE-122 Description: Realtek rtl81xx SDK Wi-Fi Driver MgntActSet_TEREDO_SET_RS_PACKET Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Realtek rtl81xx SDK Wi-Fi driver. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the MgntActS
rivileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the MgntActSet_TEREDO_SET_RS_PACKET function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-25857. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-882/
CVE ID: CVE-2025-8300 State: PUBLISHED Published: 2025-09-02T20:02:38.668Z Last Updated: 2025-09-03T14:32:59.643Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Realtek Products: rtl81xx SDK Problem Types: CWE-122 Description: Realtek rtl81xx SDK Wi-Fi Driver rtwlanu Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Realtek rtl81xx SDK Wi-Fi driver. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the N6CSet_DOT11_CIPHER_DEFAULT_KEY
rget system in order to exploit this vulnerability. The specific flaw exists within the N6CSet_DOT11_CIPHER_DEFAULT_KEY function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-26552. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-25-883/
CVE ID: CVE-2025-8301 State: PUBLISHED Published: 2025-09-02T20:02:25.857Z Last Updated: 2025-09-03T15:10:00.970Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Realtek Products: RTL8811AU Problem Types: CWE-122 Description: Realtek RTL8811AU rtwlanu.sys N6CSet_DOT11_CIPHER_DEFAULT_KEY Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Realtek RTL8811AU drivers. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the N6CSet_DOT11_CIPHER_