What’s Vulnerable › Vulnerabilities
CVE-2025-41675: Remote Command Injection via GET in Cloud Server Communication Script Due to Improper Input Neutralization
- Severity: high (CVSS 7.2 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-07-21 · updated 2026-06-17
- Weakness: CWE-78
Description
A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to improper neutralization of special elements used in an OS command.
Affected products
- Mbconnectline Mbnet.Mini Firmware: before 2.3.3 — fixed in 2.3.3
How to fix
Upgrade to a fixed version: Mbconnectline Mbnet.Mini Firmware 2.3.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-41675 or the next vulnerability affects your stack