PT-2025-33281 · Undefined · Undefined

Actuator · Published 2025-08-14 · Updated 2025-08-14 · CVE-2025-43983

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions KuWFi CPF908-CP5 WEB5.0 LCD 20210125

Description Unauthenticated access control issues exist within the endpoints 'goform/goform set cmd process' and 'goform/goform get cmd process'. These flaws allow an unauthenticated attacker to retrieve sensitive information, such as the device admin username and password, modify critical device settings, and send arbitrary SMS messages.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-43983

Affected Products

Undefined

References · 4

• 🔥 https://github.com/actuator/cve/blob/main/Kuwfi/CVE-2025-43983.txt · Exploit
• 🔥 https://github.com/actuator/cve/tree/main/KuWfi · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-43983 · Security Note
• https://drive.proton.me/urls/CN629YJ3F4#NUgX6IB4clos · Note