PT-2025-50320 · Unknown · Check Cookie

Daniel Hulliger · Published 2025-12-10 · Updated 2025-12-15 · CVE-2025-41732

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions versions prior to 2025-41732

Description An unauthenticated remote attacker can exploit unsafe sscanf calls within the check cookie() function to write arbitrary data into fixed-size stack buffers, potentially leading to full device compromise. The sscanf() function is used to read formatted input from a string, and in this case, it does not properly validate the size of the input, allowing an attacker to write beyond the bounds of the buffer. This can overwrite adjacent memory locations, potentially overwriting critical data or code, and ultimately gaining control of the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

CVE-2025-41732

Affected Products

Check Cookie

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-41732 · Security Note
• https://osv.dev/vulnerability/CVE-2025-41732 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1998723011763933423 · Twitter Post
• https://t.me/CVEtracker/39356 · Telegram Post
• https://certvde.com/de/advisories/VDE-2025-095 · Note
• https://twitter.com/CVEnew/status/1998732733246582953 · Twitter Post
• https://twitter.com/cracbot/status/2000521286343381368 · Twitter Post
• https://t.me/cveNotify/145310 · Telegram Post
• https://twitter.com/CveFindCom/status/1998719124655006125 · Twitter Post
• https://t.me/cveNotify/145419 · Telegram Post