CVE-2025-9725

Description

A vulnerability was identified in Cudy LT500E up to 2.3.12. Affected is an unknown function of the file /squashfs-root/etc/shadow of the component Web Interface. The manipulation leads to use of hard-coded password. The attack must be carried out locally. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit is publicly available and might be used. Upgrading to version 2.3.13 is able to address this issue. It is recommended to upgrade the affected component. The vendor explains: "[T]he firmware does store a default password of 'admin'. This password has been deprecated since LT500E firmware version 2.3.13 and is no longer used. The LT500E does not have an administrator password set by default; a new password (at least 8 characters ) must be manually created upon first login the web management page."

CVSS v3.1 Score

2.5

LOW

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness Type (CWE)

CWE-255 CWE-255

CWE-259 CWE-259

CWE-798 CWE-798

Affected Products

Vendor	Product	Versions
cudy	lt500e_firmware	< 2.3.13
cudy	lt500e	All

References

Exploits

https://github.com/XXRicardo/iot-cve/blob/main/CUDY/LT500E-R42-2.3.13.md https://github.com/XXRicardo/iot-cve/blob/main/CUDY/LT500E-R42-2.3.13.md#steps-to-reproduce https://github.com/XXRicardo/iot-cve/blob/main/CUDY/LT500E-R42-2.3.13.md https://github.com/XXRicardo/iot-cve/blob/main/CUDY/LT500E-R42-2.3.13.md#steps-to-reproduce

Other References

https://vuldb.com/?ctiid.322014 https://vuldb.com/?id.322014 https://vuldb.com/?submit.639346

Frequently Asked Questions

What is CVE-2025-9725? +

A vulnerability was identified in Cudy LT500E up to 2.3.12. Affected is an unknown function of the file /squashfs-root/etc/shadow of the component Web Interface. The manipulation leads to use of hard-coded password. The attack must be carried out locally. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit is publicly available and might be used. Upgrading to version 2.3.13 is able to address this issue. It is recommended to upgrade the affected component. The vendor explains: "[T]he firmware does store a default password of 'admin'. This password has been deprecated since LT500E firmware version 2.3.13 and is no longer used. The LT500E does not have an administrator password set by default; a new password (at least 8 characters ) must be manually created upon first login the web management page." It has a CVSS v3.1 base score of 2.5 (LOW).

How severe is CVE-2025-9725? +

CVE-2025-9725 has a CVSS v3.1 score of 2.5 out of 10, rated LOW. This is a low-severity vulnerability with limited impact.

What products are affected by CVE-2025-9725? +

CVE-2025-9725 affects products from cudy, specifically: lt500e, lt500e_firmware. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-9725? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2021-37000 7.7

Some Huawei wearables have a permission management vulnerability.

CVE-2025-11284 7.3

A vulnerability has been found in Zytec Dalian Zhuoyun Technology Central Authentication Service 3. Affected by this vulnerability is an …

CVE-2025-11649 7.0

A vulnerability was found in Tomofun Furbo 360 and Furbo Mini. The affected element is an unknown function of the …

CVE-2025-11666 6.7

A flaw has been found in Tenda RP3 Pro up to 22.5.7.93. This impacts an unknown function of the file …

CVE-2025-13187 5.3

A security vulnerability has been detected in Intelbras ICIP 2.0.20. Affected is an unknown function of the file /xml/sistema/acessodeusuario.xml. Such …

CVE-2025-13221 5.3

A weakness has been identified in Intelbras UnniTI 24.07.11. The affected element is an unknown function of the file /xml/sistema/usuarios.xml. …