Teccom · Teccom Connect · CVE-2025-10183
Name of the Vulnerable Software and Affected Versions:
TecCom TecConnect version 4.1
Description:
The OpenMessaging webservice in TecCom TecConnect version 4.1 contains a blind XML External Entity (XXE) injection. This allows an unauthenticated attacker to exfiltrate arbitrary files to an attacker-controlled server. TecConnect 4.1 is end-of-life as of December 2023.
Recommendations:
Upgrade to TecCom Connect 5.