PT-2025-39459 · Unknown+1 · Guanxinglu Vlarl+1

Zznq · Published 2025-09-25 · Updated 2025-09-25 · CVE-2025-10975

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GuanxingLu vlarl versions prior to 31abc0baf53ef8f5db666a1c882e1ea64def2997

Description A flaw exists in the experiments.robot.bridge.reasoning server::run reasoning server function within the experiments/robot/bridge/reasoning server.py file of the ZeroMQ component. Manipulation of the Message argument leads to deserialization, potentially allowing for remote exploitation. The exploit has been publicly disclosed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Deserialization of Untrusted Data

RCE

Weakness Enumeration

CWE-502

CWE-20

Related Identifiers

CVE-2025-10975

Affected Products

Guanxinglu Vlarl

Zeromq

References · 10

• 🔥 https://github.com/GuanxingLu/vlarl/issues/18#issue-3408978610 · Exploit
• 🔥 https://github.com/GuanxingLu/vlarl/issues/18 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-10975 · Security Note
• https://osv.dev/vulnerability/CVE-2025-10975 · Vendor Advisory
• https://twitter.com/CVEnew/status/1971331535098831207 · Twitter Post
• https://vuldb.com/?submit.653279 · Note
• https://vuldb.com/?ctiid.325846 · Note
• https://t.me/cveNotify/136462 · Telegram Post
• https://vuldb.com/?id.325846 · Note
• https://t.me/CVEtracker/33381 · Telegram Post