CVE-2025-41765CWE-862

Unchecked role in wwwupload.cgi

Critical · published March 9, 2026

CVSS v3.1

9.1

EPSS

Percentile

18.1

In the wild

Unconfirmed

What it is

Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupload.cgi endpoint to upload and apply arbitrary data. This includes, but is not limited to, contact images, HTTPS certificates, system backups for restoration, server peer configurations, and BACnet/SC server certificates and keys.

The record

Technical detail

CVSS v3.1: 9.1 · CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00270 · 18.1th percentile
Weakness: CWE-862 · Missing Authorization
Published: 2026-03-09T08:17Z

EPSS history

Timeline

09 MAR 08:17Z
Unchecked role in wwwupload.cgi
cvelistv5