CVE-2025-3325

low-risk
Published 2025-04-06

A vulnerability, which was classified as problematic, was found in iteaj iboot 物联网网关 1.1.3. This affects an unknown part of the file /core/admin/pwd of the component Admin Password Handler. The manipulation of the argument ID leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Do I need to act?

-
0.19% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.3/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Iboot

Affected Vendors

Iteaj

References (5)

Exploit https://github.com/uglory-gll/javasec/blob/main/iboot.md#1logical-loopholes
Permissions Required https://vuldb.com/?ctiid.303537
Third Party Advisory https://vuldb.com/?id.303537
Third Party Advisory https://vuldb.com/?submit.551869
Exploit https://github.com/uglory-gll/javasec/blob/main/iboot.md#1logical-loopholes
24
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal