CVE-2025-41753CWE-22path-traversal

CVE-2025-41753

Critical · published October 1, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
47.4
In the wild
Unconfirmed
What it is

The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the device, which may lead to full system compromise.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00588 · 47.4th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-10-01T11:16Z
References (1)
https://www.certvde.com/en/advisories/VDE-2025-102/ · [email protected]
EPSS history
Timeline
  • 03 OCT 03:38Z
    EPSS moved — → 1%
    epss
  • 01 OCT 06:42Z
    Path traversal in dynamically created BACnet File Objects
    cvelistv5