PT-2025-24659 · Unknown · Airleader Easy+1

Angel Lomeli + 1 · Published 2025-06-10 · Updated 2025-10-16 · CVE-2025-46612

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Airleader Master and Easy versions prior to 6.36

Description The issue allows remote attackers to execute arbitrary commands via an unrestricted file upload in the Panel Designer dashboard. This can be exploited by logging into the administrator console, which has weak and easily guessable default credentials, and then uploading a JSP file via the dashboard. The wizard/workspace.jsp endpoint is specifically vulnerable to this type of attack, allowing the upload of malicious files.

Recommendations For versions prior to 6.36, update to version 6.36 or later to resolve the issue. As a temporary workaround, consider restricting access to the administrator console and changing the default credentials to stronger, unique passwords. Additionally, restrict the ability to upload files via the Panel Designer dashboard to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-46612

Affected Products

Airleader Easy

Airleader Master

References · 6

• 🔥 https://syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-036.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-46612 · Security Note
• https://osv.dev/vulnerability/CVE-2025-46612 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1932494952090542359 · Twitter Post
• https://t.me/cveNotify/139078 · Telegram Post
• https://twitter.com/CVEnew/status/1932447712596594765 · Twitter Post