PT-2025-35404 · Cudy · Cudy Lt500E

Lxyilu · Published 2025-08-31 · Updated 2025-12-23 · CVE-2025-9725

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cudy LT500E versions prior to 2.3.13

Description A vulnerability exists in Cudy LT500E up to version 2.3.12. The issue resides in an unknown function within the /squashfs-root/etc/shadow file of the Web Interface component, leading to the use of a hard-coded password. The attack requires local access and is considered difficult to exploit. The default password stored in the firmware is 'admin'.

Recommendations Upgrade to version 2.3.13 or later to address this issue.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-259

CWE-798

CWE-255

Related Identifiers

CVE-2025-9725

Affected Products

Cudy Lt500E

References · 10

• 🔥 https://github.com/XXRicardo/iot-cve/blob/main/CUDY/LT500E-R42-2.3.13.md · Exploit
• 🔥 https://github.com/XXRicardo/iot-cve/blob/main/CUDY/LT500E-R42-2.3.13.md#steps-to-reproduce · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-9725 · Security Note
• https://osv.dev/vulnerability/CVE-2025-9725 · Vendor Advisory
• https://vuldb.com/?submit.639346 · Note
• https://t.me/CVEtracker/31362 · Telegram Post
• https://twitter.com/CVEnew/status/2003567369583562994 · Twitter Post
• https://vuldb.com/?ctiid.322014 · Note
• https://vuldb.com/?id.322014 · Note
• https://t.me/cveNotify/134504 · Telegram Post