PT-2026-28284 · Unknown · Small Http Server

Rafael Pedrero · Publicado 2026-03-26 · Atualizado 2026-03-29 · CVE-2025-41359

Positive Technologies (AI Summary)

CVSS v4.0

8.5

Alta

Vetor base

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Small HTTP Server version 3.06.36

Description The issue involves an unquoted service path in Small HTTP Server. Specifically, the vulnerability affects the executable located at 'C:Program Files (x86)shttps mghttp.exe service'. This misconfiguration allows a local attacker to place a malicious executable with the same name in a directory with higher priority, causing the service to execute the malicious file instead of the legitimate one. Exploiting this flaw could lead to arbitrary code execution, unauthorized system access, or service disruption. The vulnerable path is associated with the service configuration.

Recommendations Ensure the service path is properly quoted. Restrict physical and network access to the system.

Correção

Enumeração de Fraquezas

CWE-428

Identificadores relacionados

CVE-2025-41359

Produtos afetados

Small Http Server

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-41359 · Nota de Segurança
• https://twitter.com/CVEnew/status/2038135235758670002 · Publicação no Twitter
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-small-http-server-smallsrv · Correção
• https://twitter.com/cyberbivash/status/2037164394648351099 · Publicação no Twitter