VulnerabilityDeferred

CVE-2025-15575

This allows attackers to flash malicious firmware update files on the device.

MEDIUM 5.3EPSS 0.13%

Does this matter?

Lower severity and a low EPSS score (0.13%). Track it; it rarely justifies an emergency change on its own.

Description

The firmware update functionality does not verify the authenticity of the supplied firmware update files. This allows attackers to flash malicious firmware update files on the device. Initial analysis of the firmware update functionality does not show any cryptographic checks (e.g. digital signature checks) on the supplied firmware update files. Furthermore, ESP32 security features such as secure boot are not used.

CVSS 3.1: 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS: 0.13% probability · 3th percentile
CISA KEV: Not listed
Weakness: CWE-494
Source: 551230f0-3615-47bd-b7cc-93e92e730bbf

References

https://r.sec-consult.com/solax

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.