CVEvulnerability

CVE-2025-29270

10.0 CRITICAL Published 2025-10-31 Modified 2026-06-17 Official page ↗

Status: Deferred
Published: 2025-10-31
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 10.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses: CWE-200, CWE-284

Description

Incorrect access control in the realtime.cgi endpoint of Deep Sea Electronics devices DSE855 v1.1.0 to v1.1.26 allows attackers to gain access to the admin panel and complete control of the device.

Weakness · CWE (2)

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
CWE-284 Improper Access Control weakness

References

https://blog.byteray.co.uk/shadow-entry-discovery-of-authentication-bypass-vulnerability-in-dse855-communications-device-938e35d4b361 blog.byteray.co.uk

CVE-2025-29270

Description

Related

Weakness · CWE (2)

References