What is the CVSS score of CVE-2025-41764?

CVE-2025-41764 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Universal Bacnet Router Firmware are affected by CVE-2025-41764?

A critical remote code execution vulnerability in wwwupdate.cgi allows unauthenticated attackers to upload and execute arbitrary updates on affected systems, potentially compromising complete system…

How to fix or mitigate CVE-2025-41764?

Within 24 hours: Identify and inventory all affected systems; implement emergency network access controls to restrict wwwupdate.cgi endpoint access to trusted administrative networks only. Within 7 days: Deploy WAF rules to block unauthorized requests to wwwupdate.cgi; disable the update feature if operationally feasible; conduct threat hunting for signs of exploitation. Within 30 days: Develop and test emergency patching procedures; establish vendor communication for patch timeline; execute full remediation of all affected systems upon patch availability.

Universal Bacnet Router Firmware CVE-2025-41764

CRITICAL

Missing Authorization (CWE-862)

2026-03-09 info@cert.vde.com

Authentication Bypass Universal Bacnet Router Firmware

9.1

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:56 vuln.today

CVE Published

Mar 09, 2026 - 09:16 nvd

CRITICAL 9.1

DescriptionNVD

Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupdate.cgi endpoint to upload and apply arbitrary updates.

AnalysisAI

Unauthorized firmware upload via wwwupdate.cgi endpoint due to insufficient authorization. Remote attackers can upload and apply arbitrary firmware updates.

Technical ContextAI

CWE-862 missing authorization on firmware update endpoint. Attackers can push arbitrary firmware.

RemediationAI

Apply vendor patch. Restrict management access.

CVE-2025-41764 vulnerability details – vuln.today

Back

Universal Bacnet Router Firmware CVE-2025-41764

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Share

External POC / Exploit Code