PT-2025-42908 · Raisecom · Rax701-Gc

Hd Moore · Published 2025-10-21 · Updated 2025-10-23 · CVE-2025-11534

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Raisecom RAX701-GC

Description The affected Raisecom devices permit the establishment of SSH sessions without requiring user authentication. This could enable attackers to obtain shell access without legitimate credentials. The issue affects industrial and telecommunications equipment.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-11534

Affected Products

Rax701-Gc

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-11534 · Security Note
• https://runzero.com/advisories/raisecom-ssh-bypass-cve-2025-11534 · Note
• https://cisa.gov/news-events/ics-advisories/icsa-25-294-06 · Note
• https://t.me/cveNotify/139667 · Telegram Post
• https://twitter.com/Wh1teCoon/status/1981183147929981380 · Twitter Post
• https://t.me/pentestingnews/69953 · Telegram Post