CVE-2025-1115

A vulnerability classified as problematic was found in RT-Thread up to 5.1.0. Affected by this vulnerability is the function sys_device_close/sys_device_control/sys_device_find/sys_device_init/sys_device_open/sys_device_read/sys_device_register/sys_device_write/sys_event_delete/sys_event_recv/sys_event_send/sys_mb_delete/sys_mb_recv/sys_mb_send/sys_mb_send_wait/sys_mq_recv/sys_mq_send/sys_mq_urgent/sys_mutex_delete/sys_mutex_release/sys_mutex_take/sys_rt_timer_control/sys_rt_timer_delete/sys_rt_timer_start/sys_rt_timer_stop/sys_sem_delete/sys_sem_release/sys_sem_take/sys_shmat/sys_shmdt/sys_thread_create/sys_thread_delete/sys_thread_startup/sys_timer_delete/sys_timer_gettime/sys_timer_settime of the file rt-thread/components/lwp/lwp_syscall.c. The manipulation of the argument arg[0] leads to information disclosure. An attack has to be approached locally.

• CWE-200
• CWE-284

• https://github.com/RT-Thread/rt-thread/issues/9877Exploit, Issue Tracking, Vendor Advisory
• https://vuldb.com/?ctiid.295021Permissions Required, VDB Entry
• https://vuldb.com/?id.295021Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.489903Third Party Advisory, VDB Entry

Published

Feb 8, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-11143The Jetty URI parser has some key differences to other commo…6.5
• CVE-2025-11145Observable Discrepancy, Exposure of Sensitive Information to…7.5
• CVE-2025-11146Reflected Cross-site scripting (XSS) in Apt-Cacher-NG v3.2.1…5.4
• CVE-2025-11147Reflected cross-site scripting (XSS) in Apt-Cacher-NG v3.2.1…5.4
• CVE-2025-11148All versions of the package check-branches are vulnerable to…9.8
• CVE-2025-11149This affects all versions of the package node-static; all ve…7.5
• CVE-2025-11150Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-11151Exposure of Sensitive Information to an Unauthorized Actor, …8.2
• CVE-2025-11152Sandbox escape due to integer overflow in the Graphics: Canv…8.6
• CVE-2025-11153JIT miscompilation in the JavaScript Engine: JIT component. …7.5
• CVE-2025-11154The IDonate WordPress plugin before 2.1.13 does not have au…5.4
• CVE-2025-11155The credentials required to access the device's web server a…6.8