Unauthenticated Remote Code Execution in Affected Device's Main Web Interface by Vendor

CVE-2025-41684

What is CVE-2025-41684?

An authenticated remote attacker could exploit the vulnerability present in the affected device's Main Web Interface. The flaw arises from insufficient sanitization of user input at the tls_iotgen_setting endpoint, allowing the attacker to execute arbitrary commands with root privileges. This could potentially lead to unauthorized access and manipulation of the device, emphasizing the necessity for vendors to implement robust input validation to safeguard against such exploits.

References