deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-26925
Published: 2025-02-26
Description: Cross-Site Request Forgery (CSRF) vulnerability in Required Admin Menu Manager allows Cross Site Request Forgery.This issue affects Admin Menu Manager: from n/a through 1.0.3.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://patchstack.com/database/wordpress/plugin/admin-menu-manager/vulnerability/wordpress-admin-menu-manager-plugin-1-0-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE: CVE-2022-49732
Published: 2025-02-26
Description: In the Linux kernel, the following vulnerability has been resolved:

sock: redo the psock vs ULP protection check

Commit 8a59f9d1e3d4 ("sock: Introduce sk->sk_prot->psock_update_sk_prot()")
has moved the inet_csk_has_ulp(sk) check from sk_psock_init() to
the new tcp_bpf_update_proto() function. I'm guessing that this
was done to allow creating psocks for non-inet sockets.

Unfortunately the destruction path for psock includes the ULP
unwind, so we need to fail the sk_psock_init() itself.
Otherwise if ULP is already present we'll notice that later,
and call tcp_update_ulp() with the sk_proto of the ULP
itself, which will most likely result in the ULP looping
its callbacks.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/72fa0f65b56605b8a9ae9fba2082f2123f7fe017; https://git.kernel.org/stable/c/922309e50befb0cfa5cb65e4989b7706d6578846; https://git.kernel.org/stable/c/e34a07c0ae3906f97eb18df50902e2a01c1015b6
CVE: CVE-2024-52925
Published: 2025-02-26
Description: In OPSWAT MetaDefender Kiosk before 4.7.0, arbitrary code execution can be performed by an attacker via the MD Kiosk Unlock Device feature for software encrypted USB drives.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: https://www.opswat.com/docs/mdkiosk/release-notes/cve-2024-52925
CVE: CVE-2025-1249
Published: 2025-02-26
Description: Missing Authorization vulnerability in Marcus (aka @msykes) Events Manager events-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Events Manager: from n/a through <= 6.6.4.1.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/events-manager/vulnerability/wordpress-events-manager-plugin-6-6-4-1-broken-access-control-vulnerability?_s_id=cve
CVE: CVE-2025-1716
Published: 2025-02-26
Description: picklescan before 0.0.21 does not treat 'pip' as an unsafe global. An attacker could craft a malicious model that uses Pickle to pull in a malicious PyPI package (hosted, for example, on pypi.org or GitHub) via `pip.main()`. Because pip is not a restricted global, the model, when scanned with picklescan, would pass security checks and appear to be safe, when it could instead prove to be problematic.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-184
References: https://github.com/mmaitre314/picklescan/commit/78ce704227c51f070c0c5fb4b466d92c62a7aa3d; https://github.com/mmaitre314/picklescan/security/advisories/GHSA-655q-fx9r-782v; https://www.sonatype.com/security-advisories/cve-2025-1716
CVE: CVE-2025-25783
Published: 2025-02-26
Description: An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3 allows attackers to execute arbitrary code via uploading a crafted Zip file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://emlogpro.com; https://github.com/Ka7arotto/emlog/blob/main/emlog-3.md; https://www.emlog.net/
CVE: CVE-2025-25784
Published: 2025-02-26
Description: An arbitrary file upload vulnerability in the component \c\TemplateController.php of Jizhicms v2.5.4 allows attackers to execute arbitrary code via uploading a crafted Zip file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://jizhicms.com; https://github.com/Ka7arotto/JizhiCms/blob/main/jizhicms.md; https://www.jizhicms.cn/
CVE: CVE-2025-25785
Published: 2025-02-26
Description: JizhiCMS v2.5.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component \c\PluginsController.php. This vulnerability allows attackers to perform an intranet scan via a crafted request.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-918
References: http://jizhicms.com; https://www.jizhicms.cn/
CVE: CVE-2025-25789
Published: 2025-02-26
Description: FoxCMS v1.2.5 was discovered to contain a remote code execution (RCE) vulnerability via the index() method at \controller\Sitemap.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: http://foxcms.com; https://github.com/Ka7arotto/FoxCMS/blob/main/FoxCMS-rce3.md; https://www.foxcms.cn/
CVE: CVE-2025-25790
Published: 2025-02-26
Description: An arbitrary file upload vulnerability in the component \controller\LocalTemplate.php of FoxCMS v1.2.5 allows attackers to execute arbitrary code via uploading a crafted Zip file.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: http://foxcms.com; https://github.com/Ka7arotto/FoxCMS/blob/main/FoxCMS-upload-rce.md; https://www.foxcms.cn/
CVE: CVE-2025-25791
Published: 2025-02-26
Description: An arbitrary file upload vulnerability in the plugin installation feature of YZNCMS v2.0.1 allows attackers to execute arbitrary code via uploading a crafted Zip file.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-77
References: http://yzncms.com; https://gitee.com/ken678/YZNCMS; https://github.com/Ka7arotto/YZNCMS/blob/main/yzncms-upload.md
CVE: CVE-2025-25792
Published: 2025-02-26
Description: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the isopen parameter at admin_weixin.php.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-77
References: http://seacms.com; https://github.com/Ka7arotto/Seacms/blob/main/seacmsv13.3-rce-1.md; https://www.seacms.com/
CVE: CVE-2025-25793
Published: 2025-02-26
Description: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_notify.php.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-77
References: http://seacms.com; https://github.com/Ka7arotto/Seacms/blob/main/Seacms13.3-rce-3.md; https://www.seacms.com/
CVE: CVE-2025-25794
Published: 2025-02-26
Description: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ping.php.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-77
References: http://seacms.com; https://github.com/Ka7arotto/Seacms/blob/main/Seacms13.3-rce-4.md; https://www.seacms.com/
CVE: CVE-2025-25796
Published: 2025-02-26
Description: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_template.php.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-77
References: http://seacms.com; https://github.com/Ka7arotto/Seacms/blob/main/Seacms13.3-rce-6.md; https://www.seacms.com/
CVE: CVE-2025-25797
Published: 2025-02-26
Description: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_smtp.php.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-77
References: http://seacms.com; https://github.com/Ka7arotto/Seacms/blob/main/Seacms13.3-rce-7.md; https://www.seacms.com/
CVE: CVE-2025-25799
Published: 2025-02-26
Description: SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe.php.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-552
References: http://seacms.com; https://github.com/Ka7arotto/Seacms/blob/main/Seacms13.3-lrf.md; https://www.seacms.com/
CVE: CVE-2025-25800
Published: 2025-02-26
Description: SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe_file.php.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: http://seacms.com; https://github.com/Ka7arotto/Seacms/blob/main/Seacms13.3-lrf-2.md; https://www.seacms.com/
CVE: CVE-2025-25802
Published: 2025-02-26
Description: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_ip.php.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-77
References: http://seacms.com; https://github.com/Ka7arotto/Seacms/blob/main/Seacms13.3-rce-2.md; https://www.seacms.com/
CVE: CVE-2025-25813
Published: 2025-02-26
Description: SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component admin_files.php.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-77
References: http://seacms.com; https://github.com/Ka7arotto/Seacms/blob/main/Seacms13.3-rce-5.md; https://www.seacms.com/
CVE: CVE-2025-25818
Published: 2025-02-26
Description: A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the postStrVar function at article_save.php.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-79
References: http://emlogpro.com; https://github.com/Ka7arotto/emlog/blob/main/xss.md; https://www.emlog.net/
CVE: CVE-2025-25823
Published: 2025-02-26
Description: A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the article header at /admin/article.php.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: http://emlogpro.com; https://github.com/Ka7arotto/emlog/blob/main/xss-3.md; https://www.emlog.net/
CVE: CVE-2025-25825
Published: 2025-02-26
Description: A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Titile in the article category section.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: http://emlogpro.com; https://github.com/Ka7arotto/emlog/blob/main/xss-4.md; https://www.emlog.net/
CVE: CVE-2025-25827
Published: 2025-02-26
Description: A Server-Side Request Forgery (SSRF) in the component sort.php of Emlog Pro v2.5.4 allows attackers to scan local and internal ports via supplying a crafted URL.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-918
References: http://emlogpro.com; https://github.com/Ka7arotto/emlog/blob/main/ssrf.md; https://www.emlog.net/
CVE: CVE-2024-46226
Published: 2025-02-26
Description: A stored cross site scripting (XSS) vulnerability in HelpDeskZ < v2.0.2 allows remote attackers to execute arbitrary JavaScript in the administration panel by including a malicious payload into the file name and upload file function when creating a new ticket.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.exploit-db.com/exploits/52068; https://www.exploit-db.com/exploits/52068
CVE: CVE-2024-53427
Published: 2025-02-26
Description: decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write, as demonstrated by use of --slurp with subtraction, such as a filter of .-. when the input has a certain form of digit string with NaN (e.g., "1 NaN123" immediately followed by many more digits).
CVSS Score: 8.1 (HIGH)
CWE: CWE-843
References: https://gist.github.com/Ekkosun/a83870ce7f3b7813b9b462a395e8ad92; https://github.com/jqlang/jq/blob/71c2ab509a8628dbbad4bc7b3f98a64aa90d3297/src/decNumber/decNumber.c#L3375; https://github.com/jqlang/jq/issues/3196
CVE: CVE-2025-25462
Published: 2025-02-26
Description: A SQL Injection vulnerability was found in /admin/add-propertytype.php in PHPGurukul Land Record System Project in PHP v1.0 allows remote attackers to execute arbitrary code via the propertytype POST request parameter.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-89
References: https://github.com/terrasystemlabs/CVE-IDs/blob/main/PHP-Gurukul/Land-record/Land_SQL_Injection.pdf
CVE: CVE-2025-0941
Published: 2025-02-26
Description: MET ONE 3400+ instruments running software v1.0.41 can, under rare conditions, temporarily store credentials in plain text within the system. This data is not available to unauthenticated users.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-209
References: https://www.beckman.com/about-us/compliance/coordinated-vulnerability-disclosure/product-security-updates
CVE: CVE-2025-1634
Published: 2025-02-26
Description: A flaw was found in the quarkus-resteasy extension, which causes memory leaks when client requests with low timeouts are made. If a client request times out, a buffer is not released correctly, leading to increased memory usage and eventual application crash due to OutOfMemoryError.
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://access.redhat.com/errata/RHSA-2025:12511; https://access.redhat.com/errata/RHSA-2025:1884; https://access.redhat.com/errata/RHSA-2025:1885
CVE: CVE-2025-20111
Published: 2025-02-26
Description: A vulnerability in the health monitoring diagnostics of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an unauthenticated, adjacent attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.

This vulnerability is due to the incorrect handling of specific Ethernet frames. An attacker could exploit this vulnerability by sending a sustained rate of crafted Ethernet frames to an affected device. A successful exploit could allow the attacker to cause the device to reload.
CVSS Score: 7.4 (HIGH)
CWE: CWE-1220
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-n3kn9k-healthdos-eOqSWK4g
CVE: CVE-2025-20116
Published: 2025-02-26
Description: A vulnerability in the web UI of Cisco APIC could allow an authenticated, remote attacker to perform a stored XSS attack on an affected system. To exploit this vulnerability, the attacker must have valid administrative credentials.

This vulnerability is due to improper input validation in the web UI. An authenticated attacker could exploit this vulnerability by injecting malicious code into specific pages of the web UI. A successful exploit could allow the attacker to execute arbitrary script code in the context of the web UI or access sensitive, browser-based information.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apic-multi-vulns-9ummtg5
CVE: CVE-2025-20117
Published: 2025-02-26
Description: A vulnerability in the CLI of Cisco APIC could allow an authenticated, local attacker to execute arbitrary commands as root&nbsp;on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.

This vulnerability is due to insufficient validation of arguments that are passed to specific CLI commands. An attacker could exploit this vulnerability by including crafted input as the argument of an affected CLI command. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of root.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-77
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apic-multi-vulns-9ummtg5
CVE: CVE-2025-20118
Published: 2025-02-26
Description: A vulnerability in the implementation of the internal system processes of Cisco APIC could allow an authenticated, local attacker to access sensitive information on an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials.

This vulnerability is due to insufficient masking of sensitive information that is displayed through system CLI commands. An attacker could exploit this vulnerability by using reconnaissance techniques at the device CLI. A successful exploit could allow the attacker to access sensitive information on an affected device that could be used for additional attacks.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-212
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apic-multi-vulns-9ummtg5
CVE: CVE-2025-20119
Published: 2025-02-26
Description: A vulnerability in the system file permission handling of Cisco APIC could allow an authenticated, local attacker to overwrite critical system files, which could cause a DoS condition. To exploit this vulnerability, the attacker must have valid administrative credentials.

This vulnerability is due to a race condition with handling system files. An attacker could exploit this vulnerability by doing specific operations on the file system. A successful exploit could allow the attacker to overwrite system files, which could lead to the device being in an inconsistent state and cause a DoS condition.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-362
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apic-multi-vulns-9ummtg5
CVE: CVE-2025-20161
Published: 2025-02-26
Description: A vulnerability in the software upgrade process of Cisco Nexus 3000 Series Switches and Cisco Nexus 9000 Series Switches in standalone NX-OS mode could allow an authenticated, local attacker with valid Administrator credentials to execute a command injection attack on the underlying operating system of an affected device.

This vulnerability is due to insufficient validation of specific elements within a software image. An attacker could exploit this vulnerability by installing a crafted image. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges.&nbsp;
Note: Administrators should validate the hash of any software image before installation.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-78
References: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-ici-dpOjbWxk
CVE: CVE-2025-1726
Published: 2025-02-26
Description: There is a SQL injection issue in Esri ArcGIS Monitor versions 2023.0 through 2024.x on Windows and Linux that allows a remote, authenticated attacker with low privileges to improperly read limited database schema information by passing crafted queries. While it is possible to enumerate some internal database identifiers, the impact to the confidentiality vector is "LOW' because any sensitive data returned in a response is encrypted. There is no evidence of impact to the integrity or availability vectors. This issue is addressed in ArcGIS Monitor 2024.1.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-89
References: https://www.esri.com/arcgis-blog/products/monitor/administration/whats-new-in-arcgis-monitor-2024-1/
CVE: CVE-2024-50684
Published: 2025-02-26
Description: SunGrow iSolarCloud Android app V2.1.6.20241017 and prior uses an insecure AES key to encrypt client data (insufficient entropy). This may allow attackers to decrypt intercepted communications between the mobile app and iSolarCloud.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-330
References: https://en.sungrowpower.com/security-notice-detail-2/6126
CVE: CVE-2024-50685
Published: 2025-02-26
Description: SunGrow iSolarCloud before the October 31, 2024 remediation, is vulnerable to insecure direct object references (IDOR) via the powerStationService API model.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-639
References: https://en.sungrowpower.com/security-notice-detail-2/6118
CVE: CVE-2024-50686
Published: 2025-02-26
Description: SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the commonService API model.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-639
References: https://en.sungrowpower.com/security-notice-detail-2/6112
CVE: CVE-2024-50687
Published: 2025-02-26
Description: SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the devService API model.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-639
References: https://en.sungrowpower.com/security-notice-detail-2/6114
CVE: CVE-2024-50688
Published: 2025-02-26
Description: SunGrow iSolarCloud Android application V2.1.6.20241017 and prior contains hardcoded credentials. The application (regardless of the user account) and the cloud uses the same MQTT credentials for exchanging the device telemetry.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://en.sungrowpower.com/security-notice-detail-2/6122
CVE: CVE-2024-50689
Published: 2025-02-26
Description: SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the orgService API model.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-639
References: https://en.sungrowpower.com/security-notice-detail-2/6116
CVE: CVE-2024-50691
Published: 2025-02-26
Description: SunGrow iSolarCloud Android app V2.1.6.20241104 and prior suffers from Missing SSL Certificate Validation. The app explicitly ignores certificate errors and is vulnerable to MiTM attacks. Attackers can impersonate the iSolarCloud server and communicate with the Android app.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://en.sungrowpower.com/security-notice-detail-2/6124
CVE: CVE-2024-50693
Published: 2025-02-26
Description: SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the userService API model.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-639
References: https://en.sungrowpower.com/security-notice-detail-2/6120
CVE: CVE-2024-50696
Published: 2025-02-26
Description: SunGrow WiNet-S V200.001.00.P025 and earlier versions is missing integrity checks for firmware upgrades. Sending a specific MQTT message allows an update to an inverter or a WiNet connectivity dongle with a bogus firmware file that is located on attacker-controlled server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-494
References: https://en.sungrowpower.com/security-notice-detail-2/6140
CVE: CVE-2024-57423
Published: 2025-02-26
Description: A Cross Site Scripting vulnerability in CloudClassroom-PHP Project v1.0 allows a remote attacker to execute arbitrary code via the exid parameter of the assessment function.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/harshad-alt/CVE/blob/main/CVE-2024-57423.md; https://github.com/harshad-alt/CVE/blob/main/CVE-2024-57423.md
CVE: CVE-2024-53573
Published: 2025-02-26
Description: Unifiedtransform v2.X is vulnerable to Incorrect Access Control. Unauthorized users can access and manipulate endpoints intended exclusively for administrative use. This issue specifically affects teacher/edit/{id}.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://drive.google.com/file/d/14Or6QIpOeLEqdFm1mwxdE_NNCOwMmcFc/view; https://www.getastra.com/blog/vulnerability/improper-access-control-in-school-management-system-unifiedtransform/; https://drive.google.com/file/d/14Or6QIpOeLEqdFm1mwxdE_NNCOwMmcFc/view
CVE: CVE-2024-55581
Published: 2025-02-26
Description: When AdaCore Ada Web Server 25.0.0 is linked with GnuTLS, the default behaviour of AWS.Client is vulnerable to a man-in-the-middle attack because of lack of verification of an HTTPS server's certificate (unless the using program specifies a TLS configuration).
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: https://docs.adacore.com/corp/security-advisories/SEC.AWS-0056-v1.pdf; https://lists.debian.org/debian-lts-announce/2025/03/msg00007.html; https://docs.adacore.com/corp/security-advisories/SEC.AWS-0056-v1.pdf
CVE: CVE-2024-57040
Published: 2025-02-26
Description: TP-Link TL-WR845N devices with firmware TL-WR845N(UN)_V4_200909 and TL-WR845N(UN)_V4_190219 was discovered to contain a hardcoded password for the root account which can be obtained by analyzing downloaded firmware or via a brute force attack through physical access to the router. NOTE: The supplier has stated that this issue was fixed in firmware versions 250401 or later.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://security.iiita.ac.in/iot/hashed_password.pdf
CVE: CVE-2025-1728
Published: 2025-02-26
Description: Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE: CVE-2025-1460
Published: 2025-02-26
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.