CVE-2025-41646
An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 51.55%
- CWE
- CWE-704
- Published
- 2025-06-06
- Last modified
- 2026-03-12
Affected products
- Kunbus Revolution Pi webstatus
Weakness type
Related vulnerabilities
- CVE-2026-87546 — Incorrect type conversion or cast in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36...
- CVE-2026-69585 — Microsoft Windows Search Component Elevation of Privilege Vulnerability
- CVE-2026-50278 — iccDEV: CIccEmbedIO::Read8() size_t underflow
- CVE-2026-10080 — Boards plugin panics on WebSocket command with non-string field types
- CVE-2026-15826 — User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter
- CVE-2026-53798 — rsync < 3.5.0 Privilege Confusion via name-converter uid/gid mapping
- CVE-2026-73429 — Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)
- CVE-2026-18675 — Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid