CVE-2025-27030

The device's update mechanism retrieves metadata for software updates over an unencrypted HTTP connection and stores portions of that metadata for later use. A management interface subsequently returns this stored value in a JSON response, and the web interface responsible for displaying update information inserts that value directly into the page as HTML, allowing attacker-controlled metadata to be interpreted as script content. Additionally, the same authenticated origin provides an interface capable of executing system-level commands with root privileges.