Vulnerability details
CVE-2025-4272
Mechrevo Control Console
Mechrevo Control Console GCUService csCAPI.dll uncontrolled search path
CVSS 4.0
7.3High
Official description
A vulnerability was found in Mechrevo Control Console 1.0.2.70. It has been rated as critical. Affected by this issue is some unknown functionality in the library C:\Program Files\OEM\MECHREVO Control Center\UniwillService\MyControlCenter\csCAPI.dll of the component GCUService. The manipulation leads to uncontrolled search path. An attack has to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.3High | 4.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 7.0High | 3.1 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 7.0High | 3.0 | CVEProject cvelistV5 (CNA) (VulDB) | CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 6.0Medium | 2.0 | CVEProject cvelistV5 (CNA) (VulDB) | AV:L/AC:H/Au:S/C:C/I:C/A:C |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Mechrevo | Control Console | 1.0.2.70 | CVEProject cvelistV5 (CNA) |
References and advisories
5- https://vuldb.com/?id.307376 vdb-entry
- https://vuldb.com/?ctiid.307376 signaturepermissions-required
- https://vuldb.com/?submit.563468 third-party-advisory
- https://www.yuque.com/ba1ma0-an29k/nnxoap/bhd5ckqugggmpttp?singleDoc related
- https://drive.google.com/file/d/1VKhLyW0oglACkt-5PgTtN9oRB2jMczeh/view?usp=sharing exploit
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-05-05
- Last updated
- 2025-05-05
- State
- Published
- Assigner (CNA)
- VulDB
Exploit prediction (EPSS)
0.2%
Probability of exploitation in 30 days
9.9%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Proof of concept
- Technical impact
- Total
Weaknesses (CWE)
- CWE-427Uncontrolled Search Path
- CWE-426Untrusted Search Path