CVE-2025-43983

CRITICAL

KuWFi CPF908-CP5 WEB5.0_LCD_20210125 - Info Disclosure

Title source: llm
STIX 2.1

Description

KuWFi CPF908-CP5 WEB5.0_LCD_20210125 devices have multiple unauthenticated access control vulnerabilities within goform/goform_set_cmd_process and goform/goform_get_cmd_process. These allow an unauthenticated attacker to retrieve sensitive information (including the device admin username and password), modify critical device settings, and send arbitrary SMS messages.

References (3)

Core 3

Scores

CVSS v3 9.1
EPSS 0.0019
EPSS Percentile 41.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-306
Status published
Published Aug 14, 2025
Tracked Since Feb 18, 2026