What is the CVSS score of CVE-2025-49597?

CVE-2025-49597 has a CVSS 3.1 base score of 3.9 (Low). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 2.9%.

Which versions of Tenda are affected by CVE-2025-49597?

CVE-2025-49597 is a low-severity vulnerability in handcraftedinthealps goodby-csv (CVSS 3.9).. A patch is available.

How to fix or mitigate CVE-2025-49597?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Tenda CVE-2025-49597

EUVD-2025-18300 LOW

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)

2025-06-13 security-advisories@github.com

GHSA-x3c7-22c8-prg7

Deserialization RCE Tenda

3.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

3.9 LOW

AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 14, 2026 - 21:34 euvd

EUVD-2025-18300

Analysis Generated

Mar 14, 2026 - 21:34 vuln.today

CVE Published

Jun 13, 2025 - 20:15 nvd

LOW 3.9

DescriptionGitHub Advisory

handcraftedinthealps goodby-csv is a highly memory efficient, flexible and extendable open-source CSV import/export library. Prior to 1.4.3, goodby-csv could be used as part of a chain of methods that is exploitable when an insecure deserialization vulnerability exists in an application. This so-called "gadget chain" presents no direct threat but is a vector that can be used to achieve remote code execution if the application deserializes untrusted data due to another vulnerability. The problem is patched with Version 1.4.3.

Analysis

Technical ContextAI

Remote code execution allows an attacker to run arbitrary commands or code on the target system over a network without prior authentication. This vulnerability is classified as Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915).

RemediationAI

Apply vendor patches immediately. Restrict network access to vulnerable services. Implement network segmentation and monitoring for anomalous activity.