CVE-2025-41673 — Remote Command Injection in send_sms Action Due to Improper Input Neutralization

CVE-2025-41673

Remote Command Injection in send_sms Action Due to Improper Input Neutralization PUBLISHED

Description (CNA)

A high privileged remote attacker can execute arbitrary system commands via POST requests in the send_sms action due to improper neutralization of special elements used in an OS command.

Affected (CNA)

Vendor / product	Versions
MB connect line / mbNET.mini	affected 0.0.0 before 2.3.3
Helmholz / REX 100	affected 0.0.0 before 2.3.3

CWE

CWE-78

References

https://certvde.com/de/advisories/VDE-2025-058

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://seclists.org/fulldisclosure/2025/Jul/38