Configuration Error in Cross-Origin Resource Sharing for ZLF and IDF Products
CVE-2025-41366

5.1MEDIUM

Key Information:

Vendor

Ziv

Status
Idf And Zlf
Vendor
CVE Published:
6 June 2025

What is CVE-2025-41366?

A critical configuration error has been identified in the cross-origin resource sharing (CORS) implementation within ZLF v0.10.0-0C03-04 and IDF v0.10.0-0C03-03. This vulnerability necessitates prior authentication to the device, allowing an attacker to execute specific commands that require elevated permissions beyond standard view access. Proper mitigation strategies must be implemented to safeguard against potential exploitation.

Affected Version(s)

IDF and ZLF 0 < 1.1.0

References

https://www.incibe.es/en/incibe-cert/notices/aviso-sci/mu...

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Aarón Flecha Menéndez
Gabriel VĂ­a Echezarreta
.