PT-2025-23481 · Multilaser · Multilaser Sirius Re016 Mlt1.0

Defaultch40S · Published 2025-06-02 · Updated 2025-06-02 · CVE-2025-5437

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Multilaser Sirius RE016 MLT1.0

Description A critical issue has been found in the Password Change Handler component, specifically in the /cgi-bin/cstecgi.cgi file. The manipulation of an unknown function leads to improper authentication, allowing for remote attacks. The exploit has been publicly disclosed, and the vendor was contacted but did not respond.

Recommendations For Multilaser Sirius RE016 MLT1.0, as a temporary workaround, consider restricting access to the /cgi-bin/cstecgi.cgi file to minimize the risk of exploitation. Avoid using the Password Change Handler component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-5437

Affected Products

Multilaser Sirius Re016 Mlt1.0

References · 8

• 🔥 https://github.com/DefaultCh40s/RE016/blob/main/re016.py · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-5437 · Security Note
• https://twitter.com/CVEnew/status/1929467618718568863 · Twitter Post
• https://t.me/cvenotify/124317 · Telegram Post
• https://vuldb.com/?ctiid.310770 · Note
• https://t.me/cvetracker/25151 · Telegram Post
• https://vuldb.com/?id.310770 · Note
• https://vuldb.com/?submit.584325 · Note