PT-2025-17578 · Tcpwave · Tcpwave Ddi

Rahul Kadavil · Published 2025-04-22 · Updated 2025-06-23 · CVE-2025-43946

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TCPWave DDI version 11.34P1C2

Description The issue allows for Remote Code Execution via Unrestricted File Upload combined with Path Traversal.

Recommendations For TCPWave DDI version 11.34P1C2, consider restricting access to file upload functionality to minimize the risk of exploitation until a patch is available.

Exploit

Fix

RCE

Unrestricted File Upload

Code Injection

Weakness Enumeration

CWE-434

CWE-94

Related Identifiers

CVE-2025-43946

Affected Products

Tcpwave Ddi

References · 11

• 🔥 https://github.com/Henkel-CyberVM/CVEs/tree/main/CVE-2025-43946 · Exploit
• https://osv.dev/vulnerability/CVE-2025-43946 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-43946 · Security Note
• https://twitter.com/SecAideInfo/status/1915711149590667718 · Twitter Post
• https://twitter.com/dailycve/status/1937234109514010928 · Twitter Post
• https://twitter.com/CVEnew/status/1914746241885340015 · Twitter Post
• https://t.me/cvetracker/22153 · Telegram Post
• https://twitter.com/cybercronai/status/1915062139330433447 · Twitter Post
• https://t.me/cvedetector/23551 · Telegram Post
• https://twitter.com/cybercronai/status/1915175253858230707 · Twitter Post
• https://tcpwave.com/ddi-dns-dhcp-ipam · Note