CVE-2025-1204

HIGH Year: 2025
Weakness Type
CWE-912
View all →

Vulnerability Description

The "update" binary in the firmware of the affected product sends attempts to mount to a hard-coded, routable IP address, bypassing existing device network settings to do so. The function triggers if the 'C' button is pressed at a specific time during the boot process. If an attacker is able to control or impersonate this IP address, they could upload and overwrite files on the device.

Related Vulnerabilities

CVE-2024-39754

CRITICAL
CVSS:10.0(Critical)

A static login vulnerability exists in the wctrls functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted set of network packets can lead to root access. An attacker can send packets t...

CWE-9122024

CVE-2020-12504

CRITICAL
CVSS:9.8(Critical)

Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT...

CWE-9122020

CVE-2020-14487

CRITICAL
CVSS:9.8(Critical)

OpenClinic GA 5.09.02 contains a hidden default user account that may be accessed if an administrator has not expressly turned off this account, which may allow an attacker to login and execute arbitr...

CWE-9122020

CVE-2020-16204

CRITICAL
CVSS:9.8(Critical)

The affected product is vulnerable due to an undocumented interface found on the device, which may allow an attacker to execute commands as root on the device on the N-Tron 702-W / 702M12-W (all versi...

CWE-9122020

CVE-2021-24867

CRITICAL
CVSS:9.8(Critical)

Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are af...

CWE-9122021

CVE-2021-43987

CRITICAL
CVSS:9.8(Critical)

An additional, nondocumented administrative account exists in mySCADA myPRO Versions 8.20.0 and prior that is not exposed through the web interface, which cannot be deleted or changed through the regu...

CWE-9122021