CVE-2025-6526
Last modified
CVE-2025-6526 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. A vulnerability, which was classified as problematic, has been found in 70mai M300 up to 20250611. This issue affects some unknown processing of the component HTTP Server. EPSS estimates a 0.50% chance of exploitation in the next 30 days.
Description
A vulnerability, which was classified as problematic, has been found in 70mai M300 up to 20250611. This issue affects some unknown processing of the component HTTP Server. The manipulation leads to insufficiently protected credentials. The attack can only be done within the local network. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Metrics
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| 70mai | M300 Firmware | <= 2025-06-11 |
References
- https://vuldb.com/?ctiid.313643Permissions Required, VDB Entry
- https://vuldb.com/?id.313643Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.595447Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-6526?
How severe is CVE-2025-6526?
How do I fix CVE-2025-6526?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-65236OpenCode Systems USSD Gateway OC Release: 5 was discovered t…9.8
- CVE-2025-65237A reflected cross-site scripted (XSS) vulnerability in OpenC…6.1
- CVE-2025-65238Incorrect access control in the getSubUsersByProvider functi…6.5
- CVE-2025-65239Incorrect access control in the /aux1/ocussd/trace endpoint …4.3
- CVE-2025-6524A vulnerability classified as problematic has been found in …3.1
- CVE-2025-6525A vulnerability classified as problematic was found in 70mai…4.3
- CVE-2025-65264The kernel driver of CPUID CPU-Z v2.17 and earlier does not …5.5
- CVE-2025-65267In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper …9
- CVE-2025-6527A vulnerability, which was classified as problematic, was fo…3.1
- CVE-2025-65270Reflected cross-site scripting (XSS) vulnerability in ClinCa…6.1
- CVE-2025-65271Client-side template injection (CSTI) in Azuriom CMS admin d…8.8
- CVE-2025-65276An unauthenticated administrative access vulnerability exist…9.8
Are you affected by CVE-2025-6526?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST