PT-2026-24028 · Unknown · Wwupload.Cgi

Adrien Rey + 1 · Published 2026-03-09 · Updated 2026-03-12 · CVE-2025-41758

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Versions (affected versions not specified)

Description A low-privileged remote attacker can exploit an arbitrary file write vulnerability in the wwupload.cgi API endpoint. This is due to path traversal, which can lead to overwriting arbitrary files on the device and achieving a full system compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-41758

Affected Products

Wwupload.Cgi

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-41758 · Security Note
• https://mbs-solutions.de/mbs-2025-0001 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-41758 · Vendor Advisory
• https://twitter.com/CveFindCom/status/2030942116424110512 · Twitter Post
• https://twitter.com/cracbot/status/2032049150624424096 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2031000491799253197 · Twitter Post
• https://t.me/cveNotify/154757 · Telegram Post
• https://twitter.com/CVEnew/status/2031122572981522558 · Twitter Post
• https://twitter.com/TheHackerWire/status/2030988874382790835 · Twitter Post
• https://twitter.com/CVEarity/status/2031006259072336208 · Twitter Post