CVE-2025-41771
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
An authenticated attacker with low privileges can access an endpoint in the controller's web interface vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages, limiting impact to the notification functionality.
Risk Assessment
An attacker can manipulate or read notification messages, potentially compromising the integrity of notification data.
Recommendation
Apply patches to prevent SQL injection and restrict access to the controller's web interface.
Original NVD description (English source)
An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification functionality.