CVE-2025-41675 — Remote Command Injection via GET in Cloud Server Communication Script Due to Improper Input Neutralization

CVE-2025-41675

Remote Command Injection via GET in Cloud Server Communication Script Due to Improper Input Neutralization PUBLISHED

Description (CNA)

A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to improper neutralization of special elements used in an OS command.

Affected (CNA)

Vendor / product	Versions
MB connect line / mbNET.mini	affected 0.0.0 before 2.3.3
Helmholz / REX 100	affected 0.0.0 before 2.3.3

CWE

CWE-78

References

https://certvde.com/de/advisories/VDE-2025-058

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://seclists.org/fulldisclosure/2025/Jul/38