PT-2025-24080 · Zlf+1 · Zlf+1

Published 2025-06-06 · Updated 2025-06-06 · CVE-2025-41362

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions IDF versions 0.10.0-0C03-03 ZLF versions 0.10.0-0C03-04

Description This issue allows an attacker to store malicious payload in software that will run in the victim's browser. Exploiting this requires authenticating to the device and executing certain commands that can be executed with view permission.

Recommendations For IDF version 0.10.0-0C03-03, at the moment, there is no information about a newer version that contains a fix for this issue. For ZLF version 0.10.0-0C03-04, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-41362

Affected Products

Idf

Zlf

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-41362 · Security Note
• https://t.me/cvenotify/124897 · Telegram Post
• https://twitter.com/CVEnew/status/1930965201702060379 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-zivs-idf-and-zlf-products · Note