CVE-2025-11852

MediumCVSS 5.3

Published: 16/10/2025(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.58%

46th percentile - higher than 46% of all known CVEs

Summary

A vulnerability was found in Apeman ID71 218.53.203.117. An unknown function of the file /onvif/device_service in the ONVIF Service component allows manipulation resulting in missing authentication. The attack is possible remotely and the exploit has been made public.

Risk Assessment

Missing authentication could allow unauthorized users to access the ONVIF service and potentially take control of the device. The vendor's lack of response increases the risk.

Recommendation

Immediately restrict access to the ONVIF service from untrusted networks, implement additional authentication mechanisms, and consider network segmentation. Contact the vendor for a fix.

Other vulnerabilities in Apeman ID71

CVE-2025-11851Low
A vulnerability in Apeman ID71 EN75.8.53.20 affects a function in the /set_alias.cgi file. Manipulation of the alias argument leads to cross-site scripting (XSS). The attack can be executed remotely, and the exploit is publicly available.

Original NVD description (English source)

A vulnerability was found in Apeman ID71 218.53.203.117. The impacted element is an unknown function of the file /onvif/device_service of the component ONVIF Service. Performing manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS