PT-2025-39689 · Wayos · Wayos

Duoduo0821 · Published 2025-09-26 · Updated 2025-09-29 · CVE-2025-11045

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WAYOS versions 22.03.17 (LQ 04, LQ 05, LQ 06, LQ 07, and LQ 09)

Description A flaw exists in WAYOS that allows for command injection. This occurs due to the manipulation of the Name argument within an unknown function of the /usb paswd.asp file. The attack can be initiated remotely. The exploit is publicly available.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

CVE-2025-11045

Affected Products

Wayos

References · 14

• 🔥 https://yuque.com/yuqueyonghuexlgkz/zepczx/ogyduynf84q89x99?singleDoc · Exploit
• 🔥 https://yuque.com/yuqueyonghuexlgkz/zepczx/py3shgm1z88g9xp2?singleDoc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-11045 · Security Note
• https://twitter.com/SecAideInfo/status/1972606321275916674 · Twitter Post
• https://vuldb.com/?submit.661178 · Note
• https://vuldb.com/?submit.661153 · Note
• https://vuldb.com/?submit.661177 · Note
• https://twitter.com/VulmonFeeds/status/1971798856124789038 · Twitter Post
• https://vuldb.com/?ctiid.326082 · Note
• https://twitter.com/CVEnew/status/1971678749524471862 · Twitter Post
• https://vuldb.com/?submit.658913 · Note
• https://t.me/CVEtracker/33504 · Telegram Post
• https://vuldb.com/?id.326082 · Note
• https://vuldb.com/?submit.661168 · Note