What is CVE-2025-65287?

CVE-2025-65287 is a medium-severity vulnerability in Cdpenergy Snmp Web Pro, classified under Path Traversal. CVSS score: 4.3/10. Published 2025-12-09.

How severe is CVE-2025-65287?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Path Traversal in Cdpenergy Snmp Web Pro

CVE-2025-65287

An unauthenticated directory traversal vulnerability in cgi-bin/upload.cgi in SNMP Web Pro 1.1 allows a remote attacker to read arbitrary files. The CGI concatenates the user-supplied params directly onto the base path (/var/www/files/userScript/) using memcpy + strcat without validation or canonicalization, enabling ../ sequences to escape the intended directory. The download branch also echoes the unsanitized params into Content-Disposition, introducing header-injection risk.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.007 (50.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Cdpenergy Snmp_web_pro
Cdpenergy Snmp_web_pro_firmware — versions 1.1
N/a — versions n/a

Weakness classification (CWE)

CWE-22 — Path Traversal

References

cve@mitre.org (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2025-65287?: CVE-2025-65287 is a medium-severity vulnerability in Cdpenergy Snmp Web Pro, classified under Path Traversal. CVSS score: 4.3/10. Published 2025-12-09.
How severe is CVE-2025-65287?: Medium severity. CVSS v3 base score is 4.3 out of 10.