Skip to content
Sign in
8.8 High

CVE-2025-41717 An unauthenticated remote attacker can trick a high privileged user into uploading a malicious payload via the…

Description

An unauthenticated remote attacker can trick a high privileged user into uploading a malicious payload via the config-upload endpoint, leading to code injection as root. This results in a total loss of confidentiality, availability and integrity due to improper control of code generation ('Code Injection’).

Affected products and versions

Product Affected versions Fixed in
TC ROUTER 3002T-3G 0.0 0.0.0 → < 3.08.8 3.08.8
TC ROUTER 2002T-3G 0.0 0.0.0 → < 3.08.8 3.08.8
TC ROUTER 3002T-4G 0.0 0.0.0 → < 3.08.8 3.08.8
TC ROUTER 3002T-4G GL 0.0 0.0.0 → < 3.08.8 3.08.8
TC ROUTER 5004T-5G EU 0.0 0.0.0 → < 1.06.23 1.06.23
TC ROUTER 3002T-4G VZW 0.0 0.0.0 → < 3.08.8 3.08.8
TC ROUTER 3002T-4G ATT 0.0 0.0.0 → < 3.08.8 3.08.8
TC ROUTER 2002T-4G 0.0 0.0.0 → < 3.08.8 3.08.8
CLOUD CLIENT 1101T-TX/TX 0.0 0.0.0 → < 3.07.7 3.07.7
Show the 2 other branches
Product Affected versions Fixed in
TC CLOUD CLIENT 1002-4G ATT 0.0 0.0.0 → < 3.08.8 3.08.8
TC CLOUD CLIENT 1002-TX/TX 0.0 0.0.0 → < 3.07.7 3.07.7
Track this CVE