CVE-2025-41692
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak password generation algorithm.
Risk Assessment
An attacker with webUI admin privileges can crack system passwords and gain root access, leading to full device compromise. This is a serious breach of confidentiality, integrity, and availability.
Recommendation
Change default or generated system passwords to strong, unique values and restrict access to the webUI. Update the software to a version with an improved password generation algorithm.
Other vulnerabilities in WebUI
See all- CVE-2016-8494High
Insufficient verification of uploaded files allows attackers with webui administrators privileges to perform arbitrary code execution by uploading a new webui theme.
- CVE-2026-22110High
The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.
- CVE-2026-22109High
The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit.
Original NVD description (English source)
A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak password generation algorithm.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS