CVE-2025-41675

HIGH

mbnet.mini_firmware < 2.3.3 - OS Command Injection via Cloud Server Communication Script

Title source: llm

Description

A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to improper neutralization of special elements used in an OS command.

References (2)

Core 2

Core References

Vendor Advisory

https://certvde.com/de/advisories/VDE-2025-058

Mailing List

http://seclists.org/fulldisclosure/2025/Jul/38

Scores

CVSS v3 7.2

EPSS 0.0057

EPSS Percentile 42.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-78

Status published

Products (1)

mbconnectline/mbnet.mini_firmware < 2.3.3

Published Jul 21, 2025

Tracked Since Feb 18, 2026