CVE-2025-9094

Katalog CVE

CVSS 4.3 · Medium EPSS 0,30%

Kerentanan Incomplete Filtering of Special Elements pada thingsboard. Skor CVSS 3.1 4.3 (Medium) menurut vuldb.com.

Deskripsi (NVD)

A vulnerability was detected in ThingsBoard 4.1. This vulnerability affects unknown code of the component Add Gateway Handler. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor replies, that "[t]he fix will come within upcoming release (v4.2) and will be inherited by maintenance releases of LTS versions (starting 4.0)."

Rincian

Terbit di NVD

17 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber vuldb.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-791: Incomplete Filtering of Special Elements
CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

EPSS (30 hari)

0,30% peluang dieksploitasi; lebih tinggi dari 20,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vuldb.com/?id.320416 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.626292 advisory pihak ketiga · vdb entry
• https://drive.google.com/file/d/1cZy-rfQXsF58kJIVs4UXj7usXJuhjZjA/view permissions required
• https://vuldb.com/?ctiid.320416 permissions required · vdb entry