CVE-2025-4272
Last modified
CVE-2025-4272 is a high-severity vulnerability rated 7.3/10 on the CVSS scale. A vulnerability was found in Mechrevo Control Console 1.0.2.70. It has been rated as critical. EPSS estimates a 0.16% chance of exploitation in the next 30 days.
Description
A vulnerability was found in Mechrevo Control Console 1.0.2.70. It has been rated as critical. Affected by this issue is some unknown functionality in the library C:\Program Files\OEM\MECHREVO Control Center\UniwillService\MyControlCenter\csCAPI.dll of the component GCUService. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
Metrics
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-4272?
How severe is CVE-2025-4272?
How do I fix CVE-2025-4272?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-4268A vulnerability has been found in TOTOLINK A720R 4.1.5cu.374…6.9
- CVE-2025-4269A vulnerability was found in TOTOLINK A720R 4.1.5cu.374 and …5.3
- CVE-2025-4270A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It …7.5
- CVE-2025-42701A race condition exists in the Falcon sensor for Windows tha…5.6
- CVE-2025-42706A logic error exists in the Falcon sensor for Windows that c…6.5
- CVE-2025-4271A vulnerability was found in TOTOLINK A720R 4.1.5cu.374. It …6.9
- CVE-2025-4273Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2025-4275A vulnerability in the digital signature verification proces…7.8
- CVE-2025-4276UsbCoreDxe has a vulnerability which can be used to write ar…7.5
- CVE-2025-4277Tcg2Smm has a vulnerability which can be used to write arbit…7.5
- CVE-2025-4278An issue has been discovered in GitLab CE/EE affecting all v…8.7
- CVE-2025-4279The External image replace plugin for WordPress is vulnerabl…8.8
Are you affected by CVE-2025-4272?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST