CVE-2025-9725

A vulnerability was identified in Cudy LT500E up to 2.3.12. Affected is an unknown function of the file /squashfs-root/etc/shadow of the component Web Interface. The manipulation leads to use of hard-coded password. The attack must be carried out locally. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit is publicly available and might be used. Upgrading to version 2.3.13 is able to address this issue. It is recommended to upgrade the affected component. The vendor explains: "[T]he firmware does store a default password of 'admin'. This password has been deprecated since LT500E firmware version 2.3.13 and is no longer used. The LT500E does not have an administrator password set by default; a new password (at least 8 characters ) must be manually created upon first login the web management page."

• CWE-255
• CWE-259
• CWE-798

• https://github.com/XXRicardo/iot-cve/blob/main/CUDY/LT500E-R42-2.3.13.mdExploit, Third Party Advisory
• https://github.com/XXRicardo/iot-cve/blob/main/CUDY/LT500E-R42-2.3.13.md#steps-to-reproduceExploit, Third Party Advisory
• https://vuldb.com/?ctiid.322014Permissions Required, VDB Entry
• https://vuldb.com/?id.322014Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.639346Third Party Advisory, VDB Entry
• https://github.com/XXRicardo/iot-cve/blob/main/CUDY/LT500E-R42-2.3.13.mdExploit, Third Party Advisory
• https://github.com/XXRicardo/iot-cve/blob/main/CUDY/LT500E-R42-2.3.13.md#steps-to-reproduceExploit, Third Party Advisory

Published

Aug 31, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-9719A weakness has been identified in O2OA up to 10.0-410. This …5.4
• CVE-2025-9720A vulnerability was detected in Portabilis i-Educar up to 2.…5.4
• CVE-2025-9721A flaw has been found in Portabilis i-Educar up to 2.10. The…5.4
• CVE-2025-9722A vulnerability has been found in Portabilis i-Educar up to …5.4
• CVE-2025-9723A vulnerability was found in Portabilis i-Educar up to 2.10.…5.4
• CVE-2025-9724A vulnerability was determined in Portabilis i-Educar up to …5.4
• CVE-2025-9726A security flaw has been discovered in Campcodes Farm Manage…9.8
• CVE-2025-9727A weakness has been identified in D-Link DIR-816L 206b01. Af…9.8
• CVE-2025-9728A security vulnerability has been detected in givanz Vvveb 1…6.1
• CVE-2025-9729A vulnerability was detected in PHPGurukul Online Course Reg…9.8
• CVE-2025-9730A vulnerability was found in itsourcecode Apartment Manageme…9.8
• CVE-2025-9731A vulnerability was determined in Tenda AC9 15.03.05.19. The…7