CVE-2025-65855

CVE-2025-65855 affects Netun Solutions HelpFlash IoT devices (firmware v18_178_221102_ASCII_PRO_1R5_50) due to a critical flaw in its OTA firmware update mechanism. The vulnerability stems from hard-coded, identical WiFi credentials across all devices, coupled with a lack of update server authentication and firmware signature validation. This allows an attacker with brief physical access to activate OTA mode, establish a malicious WiFi access point using the known credentials, and deliver unauthenticated, malicious firmware via HTTP. The CVSS score of 6.6 (Medium) reflects the high impact on confidentiality, integrity, and availability, achievable with physical access and low attack complexity, leading to arbitrary code execution on this safety-critical device. There is currently no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this vulnerability.