CVE-2025-41675: fallo de gravedad alta en Helmholz REX 100
Remote Command Injection via GET in Cloud Server Communication Script Due to Improper Input Neutralization
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.2epss 0.7%
A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to improper neutralization of special elements used in an OS command.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVEs relacionadas — Helmholz REX 100
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-45274CRITICALMB connect line/Helmholz: Remote code execution via confnet serviceEPSS 1.5%CVE-2024-5672HIGHRed Lion Europe: mbNET.mini vulnerable to OS command injectionEPSS 1.2%CVE-2024-45275CRITICALMB connect line/Helmholz: Hardcoded user accounts with hard-coded passwordsEPSS 0.8%CVE-2025-41679MEDIUMUnauthenticated Buffer Overflow in Conftool Service Leading to Denial of ServiceEPSS 0.8%CVE-2025-41674HIGHRemote Command Injection in diagnostic Action Due to Improper Input NeutralizationEPSS 0.7%CVE-2025-41673HIGHRemote Command Injection in send_sms Action Due to Improper Input NeutralizationEPSS 0.7%