CVE-2025-2763
Last modified
CVE-2025-2763 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. CarlinKit CPC200-CCPA Improper Verification of Cryptographic Signature Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of CarlinKit CPC200-CCPA devices. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
CarlinKit CPC200-CCPA Improper Verification of Cryptographic Signature Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of CarlinKit CPC200-CCPA devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of update packages on USB drives. The issue results from the lack of proper verification of a cryptographic signature. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24356.
Metrics
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Carlinkit | Autokit | 2024.01.19.1541 |
References
- https://www.zerodayinitiative.com/advisories/ZDI-25-179/Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-2763?
How severe is CVE-2025-2763?
How do I fix CVE-2025-2763?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-27617Pimcore is an open source data and experience management pla…8.8
- CVE-2025-2762CarlinKit CPC200-CCPA Missing Root of Trust Local Privilege …7.8
- CVE-2025-27622Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not …4.3
- CVE-2025-27623Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not …4.3
- CVE-2025-27624A cross-site request forgery (CSRF) vulnerability in Jenkins…5.4
- CVE-2025-27625In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redir…4.3
- CVE-2025-27631The TRMTracker web application is vulnerable to LDAP injecti…6.5
- CVE-2025-27632A Host Header Injection vulnerability in TRMTracker applicat…6.1
- CVE-2025-27633The TRMTracker web application is vulnerable to reflected Cr…6.1
- CVE-2025-27636Bypass/Injection vulnerability in Apache Camel components un…5.6
- CVE-2025-27637Vasion Print (formerly PrinterLogic) before Virtual Applianc…6.1
- CVE-2025-27638Vasion Print (formerly PrinterLogic) before Virtual Applianc…9.8
Are you affected by CVE-2025-2763?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST