Which versions of M300 Firmware are affected by EUVD-2025-18955?

CVE-2025-6527 is a low-severity vulnerability in 70mai M300 (CVSS 3.1). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.

Is there a public PoC exploit available for EUVD-2025-18955?

Yes, a public proof-of-concept exploit is available for EUVD-2025-18955. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2025-18955?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

M300 Firmware EUVD-2025-18955

Q: What is the CVSS score of EUVD-2025-18955?

EUVD-2025-18955 has a CVSS 4.0 base score of 1.3 (Low). CVSS vector: CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2025-6527 LOW

Incorrect Privilege Assignment (CWE-266)

2025-06-23 cna@vuldb.com

Information Disclosure M300 Firmware 70Mai

1.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.3 LOW

CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

3.1 (LOW) 1.3 (LOW)

EUVD ID Assigned

Mar 15, 2026 - 22:10 euvd

EUVD-2025-18955

Analysis Generated

Mar 15, 2026 - 22:10 vuln.today

PoC Detected

Nov 14, 2025 - 14:46 vuln.today

Public exploit code

CVE Published

Jun 23, 2025 - 22:15 nvd

LOW 3.1

DescriptionCVE.org

A vulnerability, which was classified as problematic, was found in 70mai M300 up to 20250611. Affected is an unknown function of the component Web Server. The manipulation leads to improper access controls. The attack can only be initiated within the local network. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.