CVE-2025-41674 — Remote Command Injection in diagnostic Action Due to Improper Input Neutralization

CVE-2025-41674

Remote Command Injection in diagnostic Action Due to Improper Input Neutralization PUBLISHED

Description (CNA)

A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special elements used in an OS command.

Affected (CNA)

Vendor / product	Versions
MB connect line / mbNET.mini	affected 0.0.0 before 2.3.3
Helmholz / REX 100	affected 0.0.0 before 2.3.3

CWE

CWE-78

References

https://certvde.com/de/advisories/VDE-2025-058

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://seclists.org/fulldisclosure/2025/Jul/38