Posted by Marcus Krueppel on Jul 29
================== Overview ==================
TL;DR: Using the low-privilege “admin” user account via SSH on the IoT device “USB-Server-LXL” [1], it is possible to
modify the script /etc/init.d/lighttpd which is executed by root upon restart, leading to arbitrary code execution with
root privileges.
CVE: CVE-2025-52361
Suggested CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Suggested CVSS…
– Read More – Full Disclosure
