CVE-2025-41756

An attacker can steal valid session tokens from the universal BACnet router firmware because these tokens are visible in the web address used to access the device's update page. This can be done remotely and without needing to log in, making it easy for anyone to exploit if they know the URL.

An attacker can take complete control of the universal BACnet router by exploiting a flaw in its web interface that allows them to bypass security checks when updating the device. This can be done remotely, meaning the attacker doesn't need physical access to the device, making it a serious risk.

This vulnerability allows a low-privileged remote attacker to take complete control of a device by sending a specially crafted HTTP POST request. The attacker only needs network access to the device to exploit this weakness, making it a serious risk for systems using this firmware.

An attacker can exploit a flaw in the universal BACnet router firmware to upload and apply any type of data, such as malicious files or sensitive configuration settings, without proper authorization. This can happen remotely through a specific web endpoint, meaning the attacker doesn’t need physical access to the device.

An attacker can remotely upload and install malicious updates on the universal BACnet router firmware because the system does not properly check if they are authorized to do so. This means that anyone with access to the specific update endpoint can take control of the device without needing any special permissions.