CVE-2025-41772CWE-598

wwwupdate.cgi Session token in URL

High · published March 9, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
24.2
In the wild
Unconfirmed
What it is

An unauthenticated remote attacker can obtain valid session tokens because they are exposed in plaintext within the URL parameters of the wwwupdate.cgi endpoint in UBR.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00324 · 24.2th percentile
Weakness
CWE-598 · Use of HTTP Request With Sensitive Query String
Published
2026-03-09T08:18Z
EPSS history
Timeline
  • 09 MAR 08:18Z
    wwwupdate.cgi Session token in URL
    cvelistv5