CVE-2025-10183 — XML External Entity Injection in TecConnect 4.1

CVE-2025-10183

XML External Entity Injection in TecConnect 4.1 PUBLISHED

Description (CNA)

A blind XML External Entity (XXE) injection in the OpenMessaging webservice in TecCom TecConnect 4.1 allows an unauthenticated attacker to exfiltrate arbitrary files to an attacker-controlled server. TecConnect 4.1 is considered end-of-life as of December 2023. Users are advised to upgrade to TecCom Connect 5.

Affected (CNA)

Vendor / product	Versions
TecCom / TecConnect	affected 4.1

CWE

CWE-611

References

https://blog.blacklanternsecurity.com/p/teccom-tecconnect-41-xml-external

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.