High severity · published Jul 21, 2025
CVE-2025-41675
Remote Command Injection via GET in Cloud Server Communication Script Due to Improper Input Neutralization
7.2
CVSS
0.7%
EPSS
No
On KEV
Description
A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to improper neutralization of special elements used in an OS command.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
R1
REX 100 · Helmholz
0.0.0 before 2.3.3 · source: vendor
MB
mbNET.mini · MB connect line
0.0.0 before 2.3.3 · source: vendor
MF
Mbnet.mini Firmware · Mbconnectline
before 2.3.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-41675
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-41675
Vendor Advisory
https://certvde.com/de/advisories/VDE-2025-058
Mailing List
http://seclists.org/fulldisclosure/2025/Jul/38
More from REX 100
7.5
CVE-2025-41679
Unauthenticated Buffer Overflow in Conftool Service Leading to Denial of Service
7.2
CVE-2025-41678
SQL Injection via POST Requests Allowing Configuration Database Manipulation
7.2
CVE-2025-41674
Remote Command Injection in diagnostic Action Due to Improper Input Neutralization
7.2
CVE-2025-41673
Remote Command Injection in send_sms Action Due to Improper Input Neutralization
4.9
CVE-2025-41677
Resource Exhaustion via POST Requests to send-mail Action