CVE-2025-4692mediumCWE-266

CVE-2025-4692: medium-severity vulnerability in ABUP IoT Cloud Platform

ABUP IoT Cloud Platform Incorrect Privilege Assignment

Published · Updated

Follow this CVE+ Monitor ABUP IoT Cloud Platform

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.9epss 0.4%
Actors can use a maliciously crafted JavaScript object notation (JSON) web token (JWT) to perform privilege escalation by submitting the malicious JWT to a vulnerable method exposed on the cloud platform. If the exploit is successful, the user can escalate privileges to access any device managed by the ABUP Cloud Update Platform.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
ABUP · ABUP IoT Cloud Platform