PT-2025-17325 · Nautel · Nautel Vx Series

Shiky8 · Published 2025-04-18 · Updated 2025-04-19 · CVE-2025-28236

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nautel VX Series transmitters VX SW versions 6.4.0 and below

Description The issue is related to a remote code execution (RCE) vulnerability in the firmware update process. This allows attackers to execute arbitrary code by supplying a crafted update package to the "/#/software/upgrades" endpoint.

Recommendations For Nautel VX Series transmitters VX SW versions 6.4.0 and below, consider disabling access to the "/#/software/upgrades" endpoint until a patch is available. As a temporary workaround, restrict the ability to supply update packages to trusted sources only. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-494

Related Identifiers

CVE-2025-28236

Affected Products

Nautel Vx Series

References · 6

• 🔥 https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-28236 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-28236 · Security Note
• https://t.me/cvetracker/21945 · Telegram Post
• https://twitter.com/CVEnew/status/1913312994026750264 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1913383886324670656 · Twitter Post
• https://t.me/cvedetector/23333 · Telegram Post