CVE-2025-37146CWE-77command-injection

CVE-2025-37146

High · published October 14, 2025

CVSS v3.1
7.2
EPSS
1%
Percentile
59.0
In the wild
Unconfirmed
What it is

⚡ A single malicious command from an authenticated user is all it takes to take control! This vulnerability in network access point configuration could let attackers run arbitrary commands on your system. 🔥 Think of it as a hotel manager who opens the door to a guest without verifying their identity. Once they’re in, they can rearrange furniture, access restricted areas, or even mess with the security system! If exploited, an attacker could execute commands that might compromise your entire network, leading to data breaches or service disruptions. It’s like handing over the keys to your entire infrastructure!

Put simply

Think of it as a hotel manager who opens the door to a guest without verifying their identity. Once they’re in, they can rearrange furniture, access restricted areas, or even mess with the security system! This vulnerability allows an authenticated remote attacker to perform remote command execution via the web-based management interface of network access point configuration services, potentially taking complete control over the operating system.

What to do

If exploited, an attacker could execute commands that might compromise your entire network, leading to data breaches or service disruptions. It’s like handing over the keys to your entire infrastructure! To mitigate this vulnerability, ensure all systems are updated to the latest firmware version and implement stricter authentication measures. Regularly audit user permissions and limit access to the management interface. You've got this! Following these steps will help you secure your network and keep those sneaky attackers at bay! 🛡️

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00890 · 59.0th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2025-10-14T21:15Z
References (1)
EPSS history
Timeline
  • 14 OCT 16:42Z
    Unauthorized Filesystem Operations in System Firmware allow Authenticated Remote Code Execution
    cvelistv5