CVE-2025-41763CWE-497

Unchecked role in wwwdnload.cgi

Medium · published March 9, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
15.4
In the wild
Unconfirmed
What it is

A low‑privileged remote attacker can directly interact with the wwwdnload.cgi endpoint to download any resource available to administrators, including system backups and certificate request files.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00250 · 15.4th percentile
Weakness
CWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere
Published
2026-03-09T08:17Z
EPSS history
Timeline
  • 09 MAR 08:17Z
    Unchecked role in wwwdnload.cgi
    cvelistv5