CVE-2025-41663
For u-link Management API an unauthenticated remote attacker in a man-in-the-middle position can inject arbitrary commands in responses returned by WWH servers, which are then executed with elevated privileges.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.65%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
For u-link Management API an unauthenticated remote attacker in a man-in-the-middle position can inject arbitrary commands in responses returned by WWH servers, which are then executed with elevated privileges. To get into such a position, clients would need to use insecure proxy configurations.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.65% probability · 49th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Source
- info@cert.vde.com
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.