PT-2025-50319 · Unknown · Check Account

Daniel Hulliger · Published 2025-12-10 · Updated 2025-12-15 · CVE-2025-41730

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions versions prior to 2.3

Description An unauthenticated remote attacker can exploit unsafe sscanf calls within the check account() function to write arbitrary data into fixed-size stack buffers, potentially leading to full device compromise. The sscanf function is used to read formatted input from a string, and in this case, it does not properly validate the size of the input, allowing an attacker to write beyond the bounds of the buffer. This can overwrite adjacent memory locations, potentially gaining control of the device.

Recommendations Update to a version prior to 2.3. As a temporary workaround, consider disabling the check account() function until a patch is available.

Fix

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

CVE-2025-41730

Affected Products

Check Account

References · 10

• https://osv.dev/vulnerability/CVE-2025-41730 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-41730 · Security Note
• https://twitter.com/cracbot/status/2000521284623692005 · Twitter Post
• https://certvde.com/de/advisories/VDE-2025-095 · Note
• https://t.me/cveNotify/145418 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1998725571698700398 · Twitter Post
• https://t.me/cveNotify/145309 · Telegram Post
• https://twitter.com/CVEnew/status/1998732734534177046 · Twitter Post
• https://twitter.com/CveFindCom/status/1998719147987841059 · Twitter Post
• https://t.me/CVEtracker/39355 · Telegram Post