PT-2025-48772 · Unknown · Longwatch Devices

Published 2025-11-18 · Updated 2026-01-08 · CVE-2025-13658

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Longwatch version 6.309

Description A flaw in Longwatch devices permits unauthenticated HTTP GET requests to execute arbitrary code through an exposed endpoint. This is due to the lack of code signing and execution controls, leading to SYSTEM-level privileges. The issue allows for unauthenticated remote code execution.

Recommendations Segment and monitor Longwatch devices.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2025-15403

CVE-2025-13658

Affected Products

Longwatch Devices

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2025-13658 · Security Note
• https://bdu.fstec.ru/vul/2025-15403 · Security Note
• https://twitter.com/CrowdCyber_Com/status/1996309287702823279 · Twitter Post
• https://twitter.com/CVEnew/status/1995943878864629897 · Twitter Post
• https://ivcco.com/wp-content/uploads/Longwatch-Security-Bulletin-11-18-2025.pdf · Note
• https://twitter.com/fridaysecurity/status/1996057059964637357 · Twitter Post
• https://t.me/pentestingnews/71378 · Telegram Post
• https://twitter.com/offseq/status/1996007050933842286 · Twitter Post
• https://cyberpress.org/longwatch-rce-vulnerability · Note
• https://t.me/CVEtracker/38716 · Telegram Post
• https://twitter.com/dailytechonx/status/1996626826844663837 · Twitter Post
• https://twitter.com/Komodosec/status/2009340719245480091 · Twitter Post
• https://twitter.com/0dayPublishing/status/1995944864215703956 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1996108796020539481 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-25-336-01 · Note