CVE-2025-36729CWE-269

RACOM M!DGE2 Privilege Escalation via SDK Testing Endpoint

High · published August 26, 2025

CVSS v3.1
7.2
EPSS
0%
Percentile
37.1
In the wild
Unconfirmed
What it is

A non-primary administrator user with admin rights to the web interface but without shell access permissions can display configuration of the device including the master admin password. This vulnerability also allows the user to give themselves shell access with the root gid.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00439 · 37.1th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2025-08-26T16:26Z
EPSS history
Timeline
  • 26 AUG 16:26Z
    RACOM M!DGE2 Privilege Escalation via SDK Testing Endpoint
    cvelistv5