CVE-2025-61740
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
An authentication issue does not verify the source of a packet. This could allow an attacker to create a denial-of-service condition or modify the device configuration.
Risk Assessment
An attacker could disrupt device availability or alter its configuration without proper source verification. This may lead to service interruptions and unauthorized changes.
Recommendation
Apply available device firmware updates containing the packet source verification fix. Restrict network access to the device and monitor for unauthorized configuration changes.
Other vulnerabilities in Device firmware
See all- CVE-2026-32645Medium
Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts.
- CVE-2026-27564High
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credentials, allowing execution of commands with root privileges on the device.
- CVE-2026-27563High
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admin credentials, allowing execution of commands with root privileges on the device.
- CVE-2026-27562High
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials, allowing execution of commands with root privileges on the device.
- CVE-2026-27561High
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials, allowing execution of commands with root privileges on the device.
- CVE-2026-27560High
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials, allowing execution of commands with root privileges on the device.
- CVE-2026-49008Medium
By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application function on the device.
- CVE-2026-49007High
Vulnerability allowing access to unencrypted information in the device firmware, enabling an attacker to obtain the initial login credentials for the device's web interface.
- CVE-2026-49006Medium
By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to TLS transmission.
- CVE-2026-49005Low
The root password hash of the device can be obtained through unencrypted information in the firmware.
Original NVD description (English source)
Authentication issue that does not verify the source of a packet which could allow an attacker to create a denial-of-service condition or modify the configuration of the device.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS