CVE-2025-61941CWE-22path-traversal

CVE-2025-61941

High · published October 15, 2025

CVSS v3.0
7.2
EPSS
1%
Percentile
43.7
In the wild
Unconfirmed
What it is

⚡ A sneaky path traversal flaw in WXR9300BE6P series firmware could let a crafty admin change files and even run OS commands! Think of it like a hotel receptionist who can change guest reservations without any oversight — they could switch rooms, cancel bookings, or even access sensitive personal information without anyone noticing. This vulnerability allows an authenticated admin user to modify arbitrary files on the system, opening the door to potentially dangerous OS command execution. The consequences could be absolutely devastating, from data corruption to a full system compromise if misused.

Put simply

Think of it like a hotel receptionist who can change guest reservations without any oversight — they could switch rooms, cancel bookings, or even access sensitive personal information without anyone noticing. The path traversal issue in firmware versions before 1.10 allows an authenticated user to navigate the filesystem improperly, altering files in unintended ways and executing arbitrary commands on the operating system.

What to do

This vulnerability allows an authenticated admin user to modify arbitrary files on the system, opening the door to potentially dangerous OS command execution. The consequences could be absolutely devastating, from data corruption to a full system compromise if misused. To secure your system, update the firmware to version 1.10 or later immediately. Additionally, review user permissions to ensure that only trusted personnel have administrative access. Regularly audit logs for suspicious activities, just in case! You've got this! Update that firmware and take charge of your security! 🛡️

The record
Technical detail
CVSS v3.0
7.2 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00526 · 43.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-10-15T12:15Z
References (2)
EPSS history
Timeline
  • 15 OCT 07:24Z
    A path traversal issue exists in WXR9300BE6P series firmware versions prior to Ver.1.10
    cvelistv5