CVE-2025-6541

HighCVSS 8.8

Published: 21/10/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.69%

52th percentile - higher than 52% of all known CVEs

Summary

An arbitrary OS command may be executed on the product by a user who can log in to the web management interface.

Risk Assessment

An attacker with access to the management interface could execute arbitrary commands on the system, potentially leading to full device compromise. This poses a serious threat to system integrity and confidentiality.

Recommendation

Restrict access to the web management interface to trusted networks and accounts. Update the product to a fixed version if available.

Other vulnerabilities in Web management interface

CVE-2026-7674High
A flaw has been found in Shenzhen Libituo Technology LBT-T300-HW1 up to version 1.2.8 in the start_single_service function of the Web Management Interface. Manipulating the arguments vpn_pptp_server/vpn_l2tp_server can lead to buffer overflow.

Original NVD description (English source)

An arbitrary OS command may be executed on the product by the user who can log in to the web management interface.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS