CVE-2025-10974CWE-20CWE-502insecure-deserialization

CVE-2025-10974

Medium · published September 26, 2025

CVSS v3.1
6.3
EPSS
0%
Percentile
32.2
In the wild
Unconfirmed
What it is

A vulnerability has been found in giantspatula SewKinect up to 7fd963ceb3385af3706af02b8a128a13399dffb1. This affects the function pickle.loads of the file /calculate of the component Endpoint. Such manipulation of the argument body_parts/point_cloud leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00393 · 32.2th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-502 · Deserialization of Untrusted Data
Published
2025-09-26T02:15Z
References (7)
EPSS history
Timeline
  • 25 SEP 21:32Z
    giantspatula SewKinect Endpoint calculate pickle.loads deserialization
    cvelistv5