PT-2025-10746 · Unknown · Sipass Integrated Acc-Ap+1

Published

2025-03-11

·

Updated

2025-06-01

·

CVE-2025-27494

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions SiPass integrated AC5102 (ACC-G2) versions prior to V6.4.9 SiPass integrated ACC-AP versions prior to V6.4.9
Description A vulnerability has been identified where affected devices improperly sanitize input for the "pubkey" endpoint of the REST API. This could allow an authenticated remote administrator to escalate privileges by injecting arbitrary commands that are executed with root privileges.
Recommendations For SiPass integrated AC5102 (ACC-G2) versions prior to V6.4.9, update to version V6.4.9 or later to resolve the issue. For SiPass integrated ACC-AP versions prior to V6.4.9, update to version V6.4.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the "pubkey" endpoint of the REST API to minimize the risk of exploitation.

Fix

LPE

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-27494

Affected Products

Sipass Integrated Ac5102
Sipass Integrated Acc-Ap