CVE-2025-3499

CRITICAL

10.0

Description

The device has two web servers that expose unauthenticated REST APIs on the management network (TCP ports 8084 and 8086). Exploiting OS command injection through these APIs, an attacker can send arbitrary commands that are executed with administrative permissions by the underlying operating system.

CVE Details

CVSS v3.1 Score10.0

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published7/9/2025

Last Modified7/10/2025

Sourcenvd

Honeypot Sightings0

Weaknesses (CWE)

CWE-78

References

https://www.cvcn.gov.it/cvcn/cve/CVE-2025-3499(a6d3dc9e-0591-4a13-bce7-0f5b31ff6158)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.