CVE-2025-6763

HIGH

Cometsystem T7611 Firmware - Missing Authentication

Title source: rule
STIX 2.1

Description

A vulnerability was found in Comet System T0510, T3510, T3511, T4511, T6640, T7511, T7611, P8510, P8552 and H3531 1.60. Affected by this issue is some unknown functionality of the file /setupA.cfg of the component Web-based Management Interface. Performing manipulation results in missing authentication. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The exploit has been made public and could be used. There are still doubts about whether this vulnerability truly exists. The vendor explains, that "[d]evices described at CVE are not intended to be exposed into internet and proper security of devices is to end-users."

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry technical-description mitigation
https://vuldb.com/?id.314074
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.314074
Third Party Advisory, VDB Entry third-party-advisory
https://vuldb.com/?submit.599848

Scores

CVSS v3 8.1
EPSS 0.0193
EPSS Percentile 83.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-287 CWE-306
Status published
Products (10)
cometsystem/h3531_firmware 9-5-0-1.1327
cometsystem/p8510_firmware 4-5-8-0.3488
cometsystem/p8552_firmware 4-5-8-1.3502
cometsystem/t0510_firmware 1-5-7-5.1252
cometsystem/t3510_firmware 1-5-7-5.1252
cometsystem/t3511_firmware 1-5-7-2.1151
cometsystem/t4511_firmware 1-5-7-5.1252
cometsystem/t6640_firmware 1-5-7-5.1252
cometsystem/t7511_firmware 1-5-7-5.1251
cometsystem/t7611_firmware 1-5-7-5.1252
Published Jun 27, 2025
Tracked Since Feb 18, 2026