PT-2026-24034 · Unknown · Wwwupdate.Cgi

Adrien Rey + 1 · Published 2026-03-09 · Updated 2026-03-12 · CVE-2025-41764

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions versions prior to 2025-41764

Description Insufficient authorization enforcement allows a remote attacker to upload and apply arbitrary updates by exploiting the wwwupdate.cgi API endpoint. The wwwupdate.cgi endpoint lacks proper access controls, enabling unauthorized modification of the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-41764

Affected Products

Wwwupdate.Cgi

References · 9

• https://mbs-solutions.de/mbs-2025-0001 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-41764 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-41764 · Security Note
• https://t.me/cveNotify/154763 · Telegram Post
• https://twitter.com/CveFindCom/status/2030942152188948699 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2030985133625315462 · Twitter Post
• https://twitter.com/cracbot/status/2032049154315444284 · Twitter Post
• https://twitter.com/CVEnew/status/2031122567029719056 · Twitter Post
• https://twitter.com/TheHackerWire/status/2030946709808005589 · Twitter Post