What’s Vulnerable › Vulnerabilities

CVE-2025-11534: Authentication Bypass Using an Alternate Path or Channel in Raisecomm RAX701-GC Series

• Severity: critical (CVSS 9.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-21 · updated 2026-10-18
• Weakness: CWE-288

Description

The affected Raisecom devices allow SSH sessions to be established without completing user authentication. This could allow attackers to gain shell access without valid credentials.

Affected products

• Raisecomm RAX701-GC-WP-01 P200R002C52: Firmware version 5.5.27_20190111
• Raisecomm RAX701-GC-WP-01 P200R002C53: Firmware version 5.5.13_20180720, Firmware version 5.5.36_20190709

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-25-294-06
• https://www.runzero.com/advisories/raisecom-ssh-bypass-cve-2025-11534/

Get alerted when CVE-2025-11534 or the next vulnerability affects your stack