PT-2025-13628 · Lighttpd+1 · Lighttpd+1
Zhongwei Gu
·
Published
2025-03-30
·
Updated
2025-03-30
·
CVE-2025-2956
CVSS v2.0
6.1
Medium
| Vector | AV:A/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
TRENDnet TI-G102i versions 1.0.7.S0 through 1.0.8.S0
Description
A vulnerability was found in the HTTP Request Handler component, affecting the function
plugins call handle uri raw of the file /usr/sbin/lighttpd. This issue leads to a null pointer dereference. The attack can only be done within the local network.Recommendations
For TRENDnet TI-G102i versions 1.0.7.S0 through 1.0.8.S0 , as a temporary workaround, consider disabling the
plugins call handle uri raw function until a patch is available. Restrict access to the /usr/sbin/lighttpd file to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Improper Resource Release
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Trendnet Ti-G102I
Lighttpd