Overview CVE-2025-41739 describes a medium severity vulnerability affecting the CODESYS Control runtime system, specifically impacting installations on Linux and QNX operating systems. This vulnerability allows an unauthenticated remote attacker to potentially cause a denial-of-service (DoS) condition. The root cause lies in a race condition that can be exploited during socket communication, leading to an out-of-bounds read. Understanding the technical details and implementing the appropriate mitigation steps is crucial for protecting systems running CODESYS. Technical Details The vulnerability stems from a race condition within the communication servers of the CODESYS Control runtime system. An unauthenticated attacker can exploit this race condition…

Overview CVE-2025-41738 is a high-severity vulnerability affecting the visualization server of the CODESYS Control runtime system. This vulnerability allows an unauthenticated remote attacker to trigger a denial-of-service (DoS) condition. The issue stems from the visualization server accessing a resource with a pointer of an incorrect type, leading to potential crashes or instability within the CODESYS environment. This vulnerability was published on 2025-12-01T10:16:01.130. Technical Details The vulnerability exists due to improper handling of data types within the visualization server. Specifically, the server attempts to access a resource using a pointer that does not match the resource’s actual data type. This can…

Overview CVE-2025-41700 is a high-severity vulnerability affecting CODESYS development systems. This vulnerability allows an unauthenticated attacker to execute arbitrary code on a local system by enticing a user to open a maliciously crafted CODESYS project file. The arbitrary code is executed within the security context of the user opening the file. Technical Details The vulnerability stems from insufficient validation of data within CODESYS project files (.project or similar extensions). An attacker can embed malicious code or references to external code within the project file. When a user opens the compromised project file using the CODESYS development system, this malicious code…

Overview A critical open redirect vulnerability, identified as CVE-2025-13819, has been discovered in the web server component of MiR (Mobile Industrial Robots) Robot and Fleet software. This flaw allows a remote attacker to potentially redirect users to malicious external websites by crafting a specific URL parameter. This could be exploited to facilitate phishing attacks or other social engineering schemes, putting sensitive user data and system integrity at risk. Technical Details The vulnerability stems from insufficient validation of user-supplied input within the redirection functionality of the MiR Robot and Fleet web server. An attacker can manipulate a specific parameter in a…

Overview A medium severity security vulnerability, identified as CVE-2025-13816, has been discovered in Mogu Blog v2 up to version 5.2. This vulnerability stems from a path traversal flaw within the ZIP file handling functionality. An attacker can exploit this flaw to potentially read or write arbitrary files on the server, leading to significant security risks. The vulnerability is located within the FileOperation.unzip function of the /networkDisk/unzipFile component. Successful exploitation requires no authentication and can be performed remotely. Technical Details The root cause of CVE-2025-13816 is insufficient sanitization of the fileUrl argument passed to the FileOperation.unzip function. This lack of proper…

Overview CVE-2025-13815 is a medium-severity vulnerability identified in Mogu Blog v2, up to and including version 5.2. This vulnerability allows for unrestricted file uploads, potentially enabling attackers to upload malicious files and execute arbitrary code on the affected server. The vendor was contacted but did not respond. Technical Details The vulnerability resides in the /file/pictures endpoint of Mogu Blog v2. Specifically, the issue lies within an unknown function responsible for handling file uploads. By manipulating the filedatas argument, an attacker can bypass upload restrictions and upload any file type, including executable files. The exploit is publicly available, increasing the risk…

Overview CVE-2025-61619 describes a high-severity vulnerability found in NR (New Radio) modems. This vulnerability stems from improper input validation and can be exploited to cause a system crash, leading to a remote denial-of-service (DoS) condition. Critically, exploitation requires no additional execution privileges. Technical Details The vulnerability lies within the NR modem’s processing of specific input data. Due to insufficient validation of this input, a crafted malicious input can trigger an unhandled exception or error condition within the modem’s firmware. This, in turn, results in a system crash and the subsequent denial of service. The specific nature of the vulnerable input…

Overview CVE-2025-61618 is a high-severity vulnerability affecting nr modems. This vulnerability stems from improper input validation, which can be exploited by remote attackers to trigger a system crash, leading to a denial-of-service (DoS) condition. No additional execution privileges are required to exploit this vulnerability. Technical Details The root cause of CVE-2025-61618 lies in the inadequate validation of input data processed by the nr modem. Specifically, a malformed or unexpectedly large input can cause the modem’s processing logic to enter an unhandled state, leading to a system crash. The specific input vector and impacted function are detailed in the vendor’s advisory…

Overview CVE-2025-61617 is a high-severity vulnerability affecting NR (New Radio) modems. This vulnerability, stemming from improper input validation, can lead to a system crash and result in a remote denial of service (DoS) attack. Exploitation of this vulnerability does not require any additional execution privileges, making it a significant security concern. Technical Details The vulnerability lies in the way the NR modem handles specific input data. Due to insufficient validation, a malformed input can trigger a fatal error within the modem’s firmware, causing it to crash and rendering the device unusable. The specific input vector is not publicly disclosed to…

Overview CVE-2025-61610 is a high-severity vulnerability affecting NR (New Radio) modems. This vulnerability stems from improper input validation, potentially leading to a system crash and resulting in a remote denial of service (DoS) condition. Exploitation of this vulnerability requires no additional execution privileges. This article provides a detailed analysis of CVE-2025-61610, including technical details, CVSS analysis, potential impact, and mitigation strategies. Technical Details The vulnerability lies in the NR modem’s handling of input data. Insufficient validation of the input allows a malicious actor to send crafted data packets that trigger a system crash within the modem. The exact mechanism of…