CVE-2025-41732

Critical

Published: 10/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_cookie() function to write arbitrary data into fixed-size stack buffers, leading to full device compromise.

Risk Assessment

An attacker can fully compromise the device, potentially leading to system integrity violation and service availability issues.

Recommendation

Apply the vendor patch that fixes the unsafe sscanf calls, or restrict access to the device.

Original NVD description (English source)

An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_cookie() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.