PT-2025-21874 · Unknown · Iop-Apl-Uw Basestation3

Esharmaji · Published 2025-05-19 · Updated 2025-06-12 · CVE-2025-4905

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: iop-apl-uw basestation3 versions 3.0.4 and earlier

Description: A problem was found in the load qc pickl function of the file basestation3/QC.py, which is affected by deserialization due to the manipulation of the qc file argument. This issue must be approached locally. The exploit has been made public and may be used. Although the code maintainer has tagged the issue as closed, there is no new confirmation or release available in the GitHub repository yet.

Recommendations: For iop-apl-uw basestation3 versions 3.0.4 and earlier, as a temporary workaround, consider disabling the load qc pickl function until a patch is available. Restrict access to the basestation3/QC.py file to minimize the risk of exploitation. Avoid using the qc file argument in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Deserialization of Untrusted Data

RCE

Weakness Enumeration

CWE-502

CWE-20

Related Identifiers

CVE-2025-4905

Affected Products

Iop-Apl-Uw Basestation3

References · 10

• 🔥 https://github.com/iop-apl-uw/basestation3/issues/6#issue-3066055868 · Exploit
• 🔥 https://github.com/iop-apl-uw/basestation3/issues/6#event-17672013757 · Exploit
• 🔥 https://github.com/iop-apl-uw/basestation3/issues/6 · Exploit
• https://osv.dev/vulnerability/CVE-2025-4905 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-4905 · Security Note
• https://vuldb.com/?id.309461 · Note
• https://vuldb.com/?submit.578074 · Note
• https://vuldb.com/?ctiid.309461 · Note
• https://t.me/cvetracker/24186 · Telegram Post
• https://twitter.com/dailycve/status/1933225376349893099 · Twitter Post