CVE-2025-41646CWE-704

RevPi Webstatus application is vulnerable to an authentication bypass

Critical · published June 6, 2025

Patch now

High probability of exploitation

CVSS calls it critical at 9.8. It sits in the 98.9th percentile for exploit probability.

CVSS v3.1
9.8
EPSS
51%
Percentile
98.9
In the wild
Unconfirmed
What it is

🚨 Just a simple type conversion error is all it takes for an attacker to skip authentication entirely! 🔥 Think of it like a bouncer at a club who only checks IDs by glancing at the first letter of the name—if the first letter matches, anyone can walk right in! With this vulnerability, an unauthorized attacker could fully compromise the device, gaining complete control and access to sensitive data. This could lead to devastating consequences for the affected system, making it a prime target for exploitation!

Put simply

Think of it like a bouncer at a club who only checks IDs by glancing at the first letter of the name—if the first letter matches, anyone can walk right in! This vulnerability arises from an improper type conversion that allows attackers to bypass authentication mechanisms in the software package, granting them unauthorized access and control.

What to do

With this vulnerability, an unauthorized attacker could fully compromise the device, gaining complete control and access to sensitive data. This could lead to devastating consequences for the affected system, making it a prime target for exploitation! To protect against this exploit, immediately update to the patched version of the software as specified in the security advisories. Additionally, review your authentication processes to ensure they are robust enough to mitigate similar vulnerabilities in the future. You've got this! Just follow the steps to secure your system, and you'll be a security hero in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.51267 · 98.9th percentile
Weakness
CWE-704 · Incorrect Type Conversion or Cast
Published
2025-06-06T14:42Z
EPSS history
Timeline
  • 06 JUN 14:42Z
    RevPi Webstatus application is vulnerable to an authentication bypass
    cvelistv5