- Description
- The target device exposes a service on a specific TCP port with a configured endpoint. The access to that endpoint is granted using a Basic Authentication method. The endpoint accepts also the PUT method and it is possible to write files on the target device file system. Files are written as root. Using Postman it is possible to perform a Directory Traversal attack and write files into any location of the device file system. Similarly to the PUT method, it is possible to leverage the same mechanism to read any file from the file system by using the GET method.
- Source
- a6d3dc9e-0591-4a13-bce7-0f5b31ff6158
- NVD status
- Awaiting Analysis
CVSS 3.1
- Type
- Secondary
- Base score
- 8.8
- Impact score
- 5.9
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
- a6d3dc9e-0591-4a13-bce7-0f5b31ff6158
- CWE-280
- Hype score
- Not currently trending
CVE-2025-27025 The target device exposes a service on a specific TCP port with a configured endpoint. The access to that endpoint is granted using a Basic Authentication method. T… https://t.co/ne0KIk9yGD
@CVEnew
2 Jul 2025
511 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
[CVE-2025-27025: HIGH] Device at risk due to PUT method vulnerability allowing unsanctioned file manipulation through Directory Traversal. Heightened cyber security measures advised to prevent unauthorized a...#cve,CVE-2025-27025,#cybersecurity https://t.co/4sOuqhU92s https://t.c
@CveFindCom
2 Jul 2025
63 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes