CVE-2025-52136CWE-754

In EMQX before 5.8.6, administrators can install arbitrary novel plugins via the Dashboard web interface

Low · published August 10, 2025

CVSS v3.1
3.0
EPSS
0%
Percentile
20.2
In the wild
Unconfirmed
What it is

In EMQX before 5.8.6, administrators can install arbitrary novel plugins via the Dashboard web interface. NOTE: the Supplier's position is that this is the intended behavior; however, 5.8.6 adds a defense-in-depth feature in which a plugin's acceptability (for later Dashboard installation) is set by the "emqx ctl plugins allow" CLI command.

The record
Technical detail
CVSS v3.1
3.0 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00287 · 20.2th percentile
Weakness
CWE-754 · Improper Check for Unusual or Exceptional Conditions
Published
2025-08-10T00:00Z
EPSS history
Timeline
  • 10 AUG 00:00Z
    In EMQX before 5.8.6, administrators can install arbitrary novel plugins via the Dashboard web interface
    cvelistv5