CVE-2025-9725

Katalog CVE

CVSS 8.8 · High EPSS 0,36%

Kerentanan Credentials Management Errors pada cudy lt500e firmware. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability was identified in Cudy LT500E up to 2.3.12. Affected is an unknown function of the file /squashfs-root/etc/shadow of the component Web Interface. The manipulation leads to use of hard-coded password. The attack must be carried out locally. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit is publicly available and might be used. Upgrading to version 2.3.13 is able to address this issue. It is recommended to upgrade the affected component. The vendor explains: "[T]he firmware does store a default password of 'admin'. This password has been deprecated since LT500E firmware version 2.3.13 and is no longer used. The LT500E does not have an administrator password set by default; a new password (at least 8 characters ) must be manually created upon first login the web management page."

Rincian

Terbit di NVD

31 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-255: Credentials Management Errors
CWE-259: Use of Hard-coded Password
CWE-798: Use of Hard-coded Credentials

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 27,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/XXRicardo/iot-cve/blob/main/CUDY/LT500E-R42-2.3.13.md exploit · advisory pihak ketiga
• https://github.com/XXRicardo/iot-cve/blob/main/CUDY/LT500E-R42-2.3.13.md#steps-to-reproduce exploit · advisory pihak ketiga
• https://vuldb.com/?id.322014 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.639346 advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.322014 permissions required · vdb entry