by Kastro
Paper/Archive/CVE-2025-6763

CVE-2025-6763

Comet System T0510 — Comet System H3531 Web-based Management setupA.cfg missing authentication

EPSS 1%public exploitCVSS 9.2
critical.is priorityof 100
52
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 72.0.720 × 2014.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A vulnerability was found in Comet System T0510, T3510, T3511, T4511, T6640, T7511, T7611, P8510, P8552 and H3531 1.60. Affected by this issue is some unknown functionality of the file /setupA.cfg of the component Web-based Management Interface. Performing manipulation results in missing authentication. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The exploit has been made public and could be used. There are still doubts about whether this vulnerability truly exists. The vendor explains, that "[d]evices described at CVE are not intended to be exposed into internet and proper security of devices is to end-users."

Affected

ProductAffectedFixed inSource
T05101.60–CNA
T35101.60–CNA
T35111.60–CNA
T45111.60–CNA
T66401.60–CNA
T75111.60–CNA
T76111.60–CNA
P85101.60–CNA
P85521.60–CNA
H35311.60–CNA

Scores by source

VulDB (CNA)9.2CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
VulDB (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C
VulDB (CNA)8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:W/RC:C
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

writeupvuldb.com/?id.314074refvuldb.com/?ctiid.314074writeupvuldb.com/?submit.599848exploitgithub.com/zeke2997/CVE_request_comet_systemexploitgithub.com/zeke2997/CVE_request_comet_system#poc