deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-10675
Published: 2025-09-18
Description: A security flaw has been discovered in fuyang_lipengjun platform 1.0. This impacts the function AttributeController of the file /attribute/queryAll. Performing manipulation results in improper authorization. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://vuldb.com/?ctiid.324796; https://vuldb.com/?id.324796; https://vuldb.com/?submit.653343
CVE: CVE-2025-10676
Published: 2025-09-18
Description: A weakness has been identified in fuyang_lipengjun platform 1.0. Affected is the function BrandController of the file /brand/queryAll. Executing manipulation can lead to improper authorization. The attack can be executed remotely. The exploit has been made available to the public and could be exploited.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-266, CWE-285
References: https://vuldb.com/?ctiid.324797; https://vuldb.com/?id.324797; https://vuldb.com/?submit.653344
CVE: CVE-2025-36139
Published: 2025-09-18
Description: IBM Lakehouse (watsonx.data 2.2) is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7245387
CVE: CVE-2025-36143
Published: 2025-09-18
Description: IBM Lakehouse (watsonx.data 2.2) could allow an authenticated privileged user to execute arbitrary commands on the system due to improper validation of user supplied input.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-78
References: https://www.ibm.com/support/pages/node/7245379
CVE: CVE-2025-36146
Published: 2025-09-18
Description: IBM Lakehouse (watsonx.data 2.2) could allow an authenticated user to obtain sensitive server component version information which could aid in further attacks against the system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-497
References: https://www.ibm.com/support/pages/node/7245384
CVE: CVE-2025-50255
Published: 2025-09-18
Description: Cross Site Request Forgery (CSRF) vulnerability in Smartvista BackOffice SmartVista Suite 2.2.22 via crafted GET request.
CVSS Score: 7.8 (HIGH)
CWE: CWE-352
References: https://gitlab.com/c2at3/cve-2025-50255/-/blob/main/Bypassing_CSRF_Protection_in_Smartvista-BackOffice.pdf; https://gitlab.com/c2at3/cve-2025-50255/-/blob/main/Bypassing_CSRF_Protection_in_Smartvista-BackOffice.pdf
CVE: CVE-2025-55912
Published: 2025-09-18
Description: An issue in ClipBucket 5.5.0 and prior versions allows an unauthenticated attacker can exploit the plupload endpoint in photo_uploader.php to upload arbitrary files without any authentication, due to missing access controls in the upload handler
CVSS Score: 7.3 (HIGH)
CWE: CWE-434
References: https://github.com/MacWarrior/clipbucket-v5/blob/5.5.0/upload/actions/photo_uploader.php; https://github.com/MacWarrior/clipbucket-v5/releases?page=2; https://github.com/MacWarrior/clipbucket-v5/tree/5.5.0
CVE: CVE-2025-10687
Published: 2025-09-18
Description: A vulnerability was found in SourceCodester Responsive E-Learning System 1.0. This affects an unknown part of the file /admin/add_teacher.php. The manipulation of the argument Username results in sql injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/kele28886/cve/issues/1; https://vuldb.com/?ctiid.324811; https://vuldb.com/?id.324811
CVE: CVE-2025-10650
Published: 2025-09-18
Description: SoftIron HyperCloud 2.5.0 through 2.6.3 may incorrectly add user SSH keys to the administrator-level authorized keys under certain conditions, allowing unauthorized privilege escalation to admin via SSH. Affects non-production debug and internal development builds created between versions 2.5.0 and 2.6.3.  No generally available (GA) or customer-released production builds were affected.  There is no evidence that this issue was exposed in customer environments or production deployments.
CWE: CWE-269
References: https://advisories.softiron.cloud/
CVE: CVE-2025-26503
Published: 2025-09-18
Description: A crafted system call argument can cause memory corruption.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-119
References: https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2025-26503
CVE: CVE-2025-47906
Published: 2025-09-18
Description: If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned.
CVSS Score: 6.5 (MEDIUM)
References: https://go.dev/cl/691775; https://go.dev/issue/74466; https://groups.google.com/g/golang-announce/c/x5MKroML2yM
CVE: CVE-2025-10688
Published: 2025-09-18
Description: A vulnerability was determined in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/operation/paid.php. This manipulation of the argument inv_no/insta_amt causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89
References: https://github.com/K1nakoo/cve/blob/main/21/report.md; https://vuldb.com/?ctiid.324812; https://vuldb.com/?id.324812
CVE: CVE-2025-59424
Published: 2025-09-18
Description: LinkAce is a self-hosted archive to collect website links. Prior to 2.3.1, a Stored Cross-Site Scripting (XSS) vulnerability has been identified on the /system/audit page. The application fails to properly sanitize the username field before it is rendered in the audit log. An authenticated attacker can set a malicious JavaScript payload as their username. When an action performed by this user is recorded (e.g., generate or revoke an API token), the payload is stored in the database. The script is then executed in the browser of any user, particularly administrators, who views the /system/audit page. This vulnerability is fixed in 2.3.1.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://github.com/Kovah/LinkAce/commit/c0d21b974b32f1ca2fab550fb476c573a068e196; https://github.com/Kovah/LinkAce/security/advisories/GHSA-289g-9gff-p4wh
CVE: CVE-2025-10689
Published: 2025-09-18
Description: A vulnerability was identified in D-Link DIR-645 105B01. This issue affects the function soapcgi_main of the file /soap.cgi. Such manipulation of the argument service leads to command injection. The attack can be launched remotely. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-77, CWE-77
References: https://github.com/scanleale/IOT_sec/blob/main/DIR-645-soapcgi.pdf; https://vuldb.com/?ctiid.324813; https://vuldb.com/?id.324813
CVE: CVE-2025-30519
Published: 2025-09-18
Description: Dover Fueling Solutions ProGauge MagLink LX4 Devices have default root credentials that cannot be changed through standard 
administrative means. An attacker with network access to the device can 
gain administrative access to the system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-1391
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-07; https://www.doverfuelingsolutions.com/mea/en/products-and-solutions/automatic-tank-gauging/consoles/progauge-maglink-lx-4-console.html
CVE: CVE-2025-47698
Published: 2025-09-18
Description: An adjacent attacker without authentication can exploit this vulnerability to retrieve a set of user-privileged credentials. These credentials are present during the firmware upgrade procedure.
CWE: CWE-319
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-06
CVE: CVE-2025-53947
Published: 2025-09-18
Description: A local attacker with low privileges on the Windows system where the 
software is installed can exploit this vulnerability to corrupt 
sensitive data. A data folder is created with very weak privileges, 
allowing any user logged into the Windows system to modify its content.
CVSS Score: 7.7 (HIGH)
CWE: CWE-276
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-06
CVE: CVE-2025-54754
Published: 2025-09-18
Description: An attacker with adjacent access, without authentication, can exploit 
this vulnerability to retrieve a hard-coded password embedded in 
publicly available software. This password can then be used to decrypt 
sensitive network traffic, affecting the Cognex device.
CVSS Score: 8.0 (HIGH)
CWE: CWE-259
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-06
CVE: CVE-2025-54807
Published: 2025-09-18
Description: The secret used for validating authentication tokens is hardcoded in 
device firmware for affected versions. An attacker who obtains the 
signing key can bypass authentication, gaining complete access to the 
system.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-321
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-07; https://www.doverfuelingsolutions.com/mea/en/products-and-solutions/automatic-tank-gauging/consoles/progauge-maglink-lx-4-console.html
CVE: CVE-2025-55068
Published: 2025-09-18
Description: Dover Fueling Solutions ProGauge MagLink LX4 Devices fail to handle Unix time values beyond a certain point.
 An attacker can manually change the system time to exploit this 
limitation, potentially causing errors in authentication and leading to a
 denial-of-service condition.
CVSS Score: 8.2 (HIGH)
CWE: CWE-190
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-07; https://www.doverfuelingsolutions.com/mea/en/products-and-solutions/automatic-tank-gauging/consoles/progauge-maglink-lx-4-console.html
CVE: CVE-2025-57293
Published: 2025-09-18
Description: A command injection vulnerability in COMFAST CF-XR11 (firmware V2.7.2) exists in the multi_pppoe API, processed by the sub_423930 function in /usr/bin/webmgnt. The phy_interface parameter is not sanitized, allowing attackers to inject arbitrary commands via a POST request to /cgi-bin/mbox-config?method=SET&section=multi_pppoe. When the action parameter is set to "one_click_redial", the unsanitized phy_interface is used in a system() call, enabling execution of malicious commands. This can lead to unauthorized access to sensitive files, execution of arbitrary code, or full device compromise.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://github.com/ZZ2266/.github.io/blob/main/comfast/multi_pppoe.markdown
CVE: CVE-2025-57295
Published: 2025-09-18
Description: H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure default credentials. The root user account has no password set, and the H3C user account uses the default password "admin," both stored in the /etc/shadow file. Attackers with network access can exploit these credentials to gain unauthorized root-level access to the device via the administrative interface or other network services, potentially leading to privilege escalation, information disclosure, or arbitrary code execution.
CVSS Score: 8.0 (HIGH)
CWE: CWE-521, CWE-1188
References: https://github.com/ZZ2266/.github.io/blob/main/H3C/readme.md; https://www.h3c.com/cn/d_202504/2407151_30005_0.htm
CVE: CVE-2025-10035
Published: 2025-09-18
Description: A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-77, CWE-502, CWE-77, CWE-502
References: https://www.fortra.com/security/advisories/product-security/fi-2025-012; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-10035
CVE: CVE-2025-52873
Published: 2025-09-18
Description: Cognex In-Sight Explorer and In-Sight Camera Firmware expose 
a telnet-based service on port 23 to allow management operations such as
 firmware upgrades and device reboots, which require authentication. A 
user with protected privileges can successfully invoke the 
SetSystemConfig functionality to modify relevant device properties (such
 as network settings), contradicting the security model proposed in the 
user manual.
CVSS Score: 8.1 (HIGH)
CWE: CWE-732
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-06
CVE: CVE-2025-53969
Published: 2025-09-18
Description: Cognex In-Sight Explorer and In-Sight Camera Firmware expose 
a service implementing a proprietary protocol on TCP port 1069 to allow 
the client-side software, such as the In-Sight Explorer tool, to perform
 management operations such as changing network settings or modifying 
users' access to the device.
CVSS Score: 8.8 (HIGH)
CWE: CWE-602
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-06
CVE: CVE-2025-54497
Published: 2025-09-18
Description: Cognex In-Sight Explorer and In-Sight Camera Firmware expose 
a telnet-based service 
on port 23 to allow management operations such as firmware upgrades and 
device reboots, which require authentication. A user with protected 
privileges can successfully invoke the SetSerialPort functionality to 
modify relevant device properties (such as serial interface settings), 
contradicting the security model proposed in the user manual.
CVSS Score: 8.1 (HIGH)
CWE: CWE-732
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-06
CVE: CVE-2025-54810
Published: 2025-09-18
Description: Cognex In-Sight Explorer and In-Sight Camera Firmware expose 

a proprietary protocol on TCP port 1069 to perform management operations
 such as modifying system properties. The user management functionality 
handles sensitive data such as registered usernames and passwords over 
an unencrypted channel, allowing an adjacent attacker to intercept valid
 credentials to gain access to the device.
CVSS Score: 8.0 (HIGH)
CWE: CWE-294
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-06
CVE: CVE-2025-54818
Published: 2025-09-18
Description: Cognex In-Sight Explorer and In-Sight Camera Firmware expose 

a proprietary protocol on TCP port 1069 to perform management operations
 such as modifying system properties. The user management functionality 
handles sensitive data such as registered usernames and passwords over 
an unencrypted channel, allowing an adjacent attacker to intercept valid
 credentials to gain access to the device.
CVSS Score: 8.0 (HIGH)
CWE: CWE-319
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-06
CVE: CVE-2025-54860
Published: 2025-09-18
Description: Cognex In-Sight Explorer and In-Sight Camera Firmware expose a telnet-based service on port 23 in order to allow 
management operations on the device such as firmware upgrades and device
 reboot requiring an authentication. A wrong management of login 
failures of the service allows a denial-of-service attack, leaving the telnet service 
into an unreachable state.
CVSS Score: 7.7 (HIGH)
CWE: CWE-307
References: https://www.cisa.gov/news-events/ics-advisories/icsa-25-261-06
CVE: CVE-2025-59215
Published: 2025-09-18
Description: Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59215
CVE: CVE-2025-59216
Published: 2025-09-18
Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59216
CVE: CVE-2025-59220
Published: 2025-09-18
Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362, CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59220
CVE: CVE-2025-59691
Published: 2025-09-18
Description: PureVPN client applications on Linux through September 2025 allow IPv6 traffic to leak outside the VPN tunnel upon network events such as Wi-Fi reconnect or system resume. In the CLI client, the VPN auto-reconnects and claims to be connected, but IPv6 traffic is no longer routed or blocked. In the GUI client, the IPv6 connection remains functional after disconnection until the user clicks Reconnect. In both cases, the real IPv6 address is exposed to external services, violating user privacy and defeating the advertised IPv6 leak protection. This affects CLI 2.0.1 and GUI 2.10.0.
CVSS Score: 3.7 (LOW)
CWE: CWE-669
References: https://anagogistis.com/posts/purevpn-ipv6-leak/
CVE: CVE-2025-59692
Published: 2025-09-18
Description: PureVPN client applications on Linux through September 2025 mishandle firewalling. They flush the system's existing iptables rules and apply default ACCEPT policies when connecting to a VPN server. This removes firewall rules that may have been configured manually or by other software (e.g., UFW, container engines, or system security policies). Upon VPN disconnect, the original firewall state is not restored. As a result, the system may become unintentionally exposed to network traffic that was previously blocked. This affects CLI 2.0.1 and GUI 2.10.0.
CVSS Score: 3.7 (LOW)
CWE: CWE-669
References: https://anagogistis.com/posts/purevpn-ipv6-leak/
CVE: CVE-2025-30755
Published: 2025-09-19
Description: OpenGrok 1.14.1 has a reflected Cross-Site Scripting (XSS) issue when producing the cross reference page. This happens through improper handling of the revision parameter. The application reflects unsanitized user input into the HTML output.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.oracle.com/security-alerts/all-oracle-cves-outside-other-oracle-public-documents.html
CVE: CVE-2025-6198
Published: 2025-09-19
Description: There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X13SEM-F . An attacker can update the system firmware with a specially crafted image.
CVSS Score: 7.2 (HIGH)
CWE: CWE-347
References: https://www.supermicro.com/en/support/security_BMC_IPMI_Sept_2025
CVE: CVE-2025-10690
Published: 2025-09-19
Description: The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to unauthorized arbitrary file uploads due to a missing capability check on the 'beplus_import_pack_install_plugin' function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to upload zip files containing webshells disguised as plugins from remote locations to achieve remote code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://themeforest.net/item/goza-nonprofit-charity-wordpress-theme/23781575; https://www.cve.org/CVERecord?id=CVE-2025-5394; https://www.wordfence.com/threat-intel/vulnerabilities/id/628bfa19-2ffa-426b-8b88-22a0c4d0ba92?source=cve
CVE: CVE-2025-59712
Published: 2025-09-19
Description: Snipe-IT before 8.1.18 allows XSS.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/grokability/snipe-it/releases/tag/v8.1.18
CVE: CVE-2025-59713
Published: 2025-09-19
Description: Snipe-IT before 8.1.18 allows unsafe deserialization.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-502
References: https://github.com/grokability/snipe-it/releases/tag/v8.1.18
CVE: CVE-2025-59714
Published: 2025-09-19
Description: In Internet2 Grouper 5.17.1 before 5.20.5, group admins who are not Grouper sysadmins can configure loader jobs.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://spaces.at.internet2.edu/display/Grouper/Grouper+bug+-+GRP-6311+-+non-Grouper-admins+can+configure+loader+jobs; https://spaces.at.internet2.edu/display/Grouper/Grouper+bug+-+GRP-6311+-+non-Grouper-admins+can+configure+loader+jobs
CVE: CVE-2025-59715
Published: 2025-09-19
Description: SMSEagle before 6.11 allows reflected XSS via a username or contact phone number.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.smseagle.eu/security-advisory/resolved-xss-in-smseagle-software-6-11/
CVE: CVE-2025-7937
Published: 2025-09-19
Description: There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X12STW . An attacker can update the system firmware with a specially crafted image.
CVSS Score: 7.2 (HIGH)
CWE: CWE-347
References: https://www.supermicro.com/en/support/security_BMC_IPMI_Sept_2025
CVE: CVE-2025-59717
Published: 2025-09-19
Description: In the @digitalocean/do-markdownit package through 1.16.1 (in npm), the callout and fence_environment plugins perform .includes substring matching if allowedClasses or allowedEnvironments is a string (instead of an array).
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-843
References: https://gist.github.com/thesmartshadow/dd19665f1f51a4e3c7a766e70c9eafd0; https://github.com/digitalocean/do-markdownit; https://www.npmjs.com/package/@digitalocean/do-markdownit
CVE: CVE-2025-8487
Published: 2025-09-19
Description: The Kubio AI Page Builder plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the kubio-image-hub-install-plugin AJAX action in all versions up to, and including, 2.6.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install the Image Hub plugin.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/kubio/tags/2.6.3/lib/integrations/image-hub/image-hub.php#L70; https://plugins.trac.wordpress.org/changeset/3361499/kubio/trunk/lib/integrations/image-hub/image-hub.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/1f528c89-2b8c-4750-b9eb-47ebd8c1630e?source=cve
CVE: CVE-2025-10146
Published: 2025-09-19
Description: The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘user_ids’ parameter in all versions up to, and including, 3.3.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/download-manager/tags/3.3.23/src/Admin/views/stats/history.php#L225; https://www.wordfence.com/threat-intel/vulnerabilities/id/b1adb414-8945-4e11-8770-dab3285d608e?source=cve
CVE: CVE-2025-5955
Published: 2025-09-19
Description: The Service Finder SMS System plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.0. This is due to the plugin not verifying a user's phone number before logging them in. This makes it possible for unauthenticated attackers to login as arbitrary users.
CVSS Score: 8.1 (HIGH)
CWE: CWE-288
References: https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793; https://www.wordfence.com/threat-intel/vulnerabilities/id/cc4598a7-d5cf-4553-b29a-659fe288ece9?source=cve
CVE: CVE-2025-10456
Published: 2025-09-19
Description: A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT). Specifically, an attacker could exploit a flaw that causes the BLE target (i.e., the device under attack) to attempt to disconnect a fixed channel, which is not allowed per the Bluetooth specification. This leads to undefined behavior, including potential assertion failures, crashes, or memory corruption, depending on the BLE stack implementation.
CVSS Score: 7.1 (HIGH)
CWE: CWE-190
References: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-hcc8-3qr7-c9m8
CVE: CVE-2025-10457
Published: 2025-09-19
Description: The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a connection request. Instead, it relies solely on identifier matching.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-358
References: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xqj6-vh76-2vv8