CVE-2025-2764 is a critical code execution vulnerability affecting CarlinKit CPC200-CCPA and Autokit devices. The flaw lies in the update.cgi script's improper verification of cryptographic signatures on update packages, allowing network-adjacent attackers to execute arbitrary code as root. Although authentication is typically required, the existing mechanism can be bypassed. With a CVSS score of 8.0 (High), this vulnerability presents a significant risk due to its network-adjacent attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. The ability to bypass authentication further exacerbates the severity. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules for Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, indicating low public awareness at this time.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2024.01.19.1541CPE matchmatch criteria | cpe:2.3:a:carlinkit:autokit:2024.01.19.1541:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.