CVE-2025-11045

HIGH

WAYOS LQ_04, LQ_05, LQ_06, LQ_07, LQ_09 22.03.17 - OS Command Injection via Name Parameter

Title source: llm
STIX 2.1

Description

A vulnerability was identified in WAYOS LQ_04, LQ_05, LQ_06, LQ_07 and LQ_09 22.03.17. This affects an unknown function of the file /usb_paswd.asp. The manipulation of the argument Name leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used.

References (9)

Core 9
Core References
Permissions Required, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.326082
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.326082
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.658913
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.661153
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.661168
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.661177
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.661178

Scores

CVSS v3 7.3
EPSS 0.0207
EPSS Percentile 78.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-74 CWE-77
Status published
Products (5)
WAYOS/LQ_04 22.03.17
WAYOS/LQ_05 22.03.17
WAYOS/LQ_06 22.03.17
WAYOS/LQ_07 22.03.17
WAYOS/LQ_09 22.03.17
Published Sep 26, 2025
Tracked Since Feb 18, 2026