CVE-2025-37162
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk58th percentile - higher than 58% of all known CVEs
Summary
A vulnerability in the command line interface of affected devices could allow an authenticated remote attacker to conduct a command injection attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
Risk Assessment
An authenticated attacker can execute arbitrary commands on the system, potentially leading to full device compromise.
Recommendation
Apply vendor-provided patches and restrict access to the command line interface.
Other vulnerabilities in Unknown Device
See all- CVE-2025-41732Critical
An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_cookie() function to write arbitrary data into fixed-size stack buffers, leading to full device compromise.
- CVE-2025-41730Critical
An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_account() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.
- CVE-2025-41734Critical
An unauthenticated remote attacker can execute arbitrary PHP files and gain full access to the affected devices.
- CVE-2025-41733Critical
The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.
- CVE-2026-32646High
A specific administrative endpoint is accessible without proper authentication, exposing device management functions. Lack of access control allows unauthorized users to access sensitive operations.
- CVE-2025-41697Medium
An attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g. with the credentials obtained from CVE-2025-41692.
Original NVD description (English source)
A vulnerability in the command line interface of affected devices could allow an authenticated remote attacker to conduct a command injection attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS