Revpi Status CVE-2025-41646

CRITICAL REAL-WORLD RISK. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U) indicates: (1) Network-accessible without authentication or user interaction, (2) Low attack complexity requiring no special conditions or knowledge, (3) No privileges required—completely unauthenticated access. This combination places it in the highest exploitability tier. The complete impact scope (C:H/I:H/A:H) demonstrates total device compromise. Without KEV confirmation or EPSS score data, defensive posture must assume: active exploitation is probable given the network accessibility and authentication bypass nature; automated attack tools can be rapidly developed; technical impact is catastrophic. This is NOT a high-CVSS-but-low-real-risk issue—all signals converge on urgent priority. The authentication bypass combined with remote network access creates immediate threat for exposed systems.

An unauthenticated attacker located remotely (e.g., internet-connected) crafts a malicious authentication request that exploits the type conversion flaw. Example scenarios: (1) BOOLEAN COERCION: Attacker submits password field as boolean true or non-empty array instead of string, causing type juggling to evaluate as 'authenticated'; (2) INTEGER WRAPAROUND: Attacker submits user ID as negative integer or large number causing integer overflow that maps to administrative account; (3) NULL/UNDEFINED BYPASS: Attacker omits or misrepresents credential fields in formats (JSON, XML) where type absence/mismatch bypasses validation. The low attack complexity indicates minimal reconnaissance needed. No user interaction required—attacker directly communicates with authentication endpoint. Upon successful bypass, attacker gains full device access for data exfiltration, malware installation, lateral movement, or denial-of-service. POC availability not confirmed but likely to emerge rapidly given network accessibility and authentication bypass characteristics.