PT-2025-32446 · Lighttpd+1 · Lighttpd+1

Tpchecker · Published 2025-07-29 · Updated 2026-01-02 · CVE-2025-8759

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: TRENDnet TN-200 version 1.02b02

Description: A vulnerability exists in the TRENDnet TN-200 device. The issue resides in the Lighttpd component, where manipulation of the secdownload.secret argument with the input neV3rUseMe results in the use of a hard-coded cryptographic key. This issue can be exploited remotely, but the attack complexity is considered high and exploitation appears difficult. The exploit has been publicly disclosed. The vendor was informed of the disclosure but did not respond.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-321

CWE-320

Related Identifiers

BDU:2025-09644

CVE-2025-8759

Affected Products

Lighttpd

Trendnet Tn-200

References · 15

• 🔥 https://notion.so/23f54a1113e7801e944ec65a2f7c5448 · Exploit
• https://osv.dev/vulnerability/CVE-2025-8759 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8759 · Security Note
• https://bdu.fstec.ru/vul/2025-09644 · Security Note
• https://vuldb.com/?ctiid.319264 · Note
• https://twitter.com/VulmonFeeds/status/1954235984087802167 · Twitter Post
• https://t.me/cveNotify/147538 · Telegram Post
• https://twitter.com/marcin_brz81183/status/1954627253368930552 · Twitter Post
• https://notion.so/Misconfiguration-in-TN-200-NAS-23f54a1113e7801e944ec65a2f7c5448 · Note
• https://vuldb.com/?id.319264 · Note
• https://vuldb.com/?submit.624555 · Note
• https://t.me/cveNotify/131560 · Telegram Post
• https://twitter.com/CVEnew/status/1954229688383013371 · Twitter Post
• https://trendnet.com/langru/products/nas-enclosure/TN-200 · Note
• https://t.me/CVEtracker/29591 · Telegram Post