CVE-2025-41692

MediumCVSS 6.8

Published: 09/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

20th percentile - higher than 20% of all known CVEs

Summary

A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak password generation algorithm.

Risk Assessment

An attacker with webUI admin privileges can crack system passwords and gain root access, leading to full device compromise. This is a serious breach of confidentiality, integrity, and availability.

Recommendation

Change default or generated system passwords to strong, unique values and restrict access to the webUI. Update the software to a version with an improved password generation algorithm.

Other vulnerabilities in WebUI

CVE-2016-8494High
Insufficient verification of uploaded files allows attackers with webui administrators privileges to perform arbitrary code execution by uploading a new webui theme.

Original NVD description (English source)

A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak password generation algorithm.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS