PT-2025-24083 · Zlf+1 · Zlf+1

Published 2025-06-06 · Updated 2025-06-06 · CVE-2025-41365

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions IDF versions 0.10.0-0C03-03 ZLF versions 0.10.0-0C03-04

Description The issue allows an attacker to store malicious payload in software that will run in the victim's browser. Exploiting this requires authenticating to the device and executing certain commands that can be executed only with permissions higher than the view permission.

Recommendations For IDF version 0.10.0-0C03-03, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For ZLF version 0.10.0-0C03-04, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-41365

Affected Products

Idf

Zlf

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-41365 · Security Note
• https://twitter.com/CVEnew/status/1930965197092475104 · Twitter Post
• https://t.me/cvenotify/124900 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-zivs-idf-and-zlf-products · Note