NVD disclosure day

Published threat advisories for January 16, 2025

CVE advisoryCRITICAL

CVE-2024-48885

Fortinet FortiRecorder FortiVoice FortiWeb Path Traversal Privilege Escalation

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A path traversal vulnerability in Fortinet FortiRecorder, FortiVoice, and FortiWeb products allows an attacker to escalate privileges. If reachable, this could lead to unauthorized system access or control. This issue is relevant due to the potential for privilege escalation on network-facing appliances and security ga

NVD modified: NVD date unavailable

CVE advisoryCRITICAL

CVE-2025-22916

RE11S Firmware Stack Overflow in PPPoE Setup

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A stack overflow vulnerability in RE11S firmware's PPPoE setup function can be triggered by a malformed username, potentially allowing remote attackers to compromise the device. This issue is reachable via network-accessible configuration interfaces and could lead to service disruption or unauthorized control.

NVD modified: NVD date unavailable

CVE advisoryCRITICAL

CVE-2025-22912

Edimax RE11S Command Injection Vulnerability

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A command injection vulnerability in the RE11S firmware allows remote execution of unauthorized commands via the `/goform/formAccept` component. This could lead to device compromise and impact network security if the administrative interface is reachable.

NVD modified: NVD date unavailable

CVE advisoryCRITICAL

CVE-2025-22907

RE11S Firmware Stack Overflow Vulnerability

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A critical stack overflow vulnerability exists in Edimax RE11S wireless range extender firmware, exploitable via a network request without authentication. This flaw could allow an attacker to impact the device's confidentiality, integrity, and availability.

NVD modified: NVD date unavailable

CVE advisoryCRITICAL

CVE-2025-22906

RE11S Firmware Command Injection Vulnerability

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A critical command injection vulnerability in RE11S firmware allows remote attackers to execute arbitrary commands by sending a crafted request to the WAN configuration interface. This could compromise device functionality and network services. The relevance and exposure across deployed devices need to be confirmed.

NVD modified: NVD date unavailable

CVE advisoryCRITICAL

CVE-2025-22904

Edimax RE11S Firmware setWAN Stack Overflow

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A critical stack overflow vulnerability exists in network device firmware that could allow an attacker to gain significant control over affected devices. The vulnerability is triggered by specific input to the `setWAN` function and could lead to denial of service or unauthorized access. Confirming if this technology is

NVD modified: NVD date unavailable