CVE-2025-7769

Tigo Energy's CCA is vulnerable to a command injection vulnerability in the /cgi-bin/mobile_api endpoint when the DEVICE_PING command is called, allowing remote code execution due to improper handling of user input. When used with default credentials, this enables attackers to execute arbitrary commands on the device that could cause potential unauthorized access, service disruption, and data exposure.

CVSS

No CVSS.

References

Link	Resource
https://www.cisa.gov/news-events/ics-advisories/icsa-25-217-02

Configurations

No configuration.

History

07 Aug 2025, 21:26

Type	Values Removed	Values Added
Summary		(es) Tigo Energy's CCA es vulnerable a una vulnerabilidad de inyección de comandos en el endpoint /cgi-bin/mobile_api al ejecutar el comando DEVICE_PING, lo que permite la ejecución remota de código debido al manejo inadecuado de la entrada del usuario. Al usar las credenciales predeterminadas, esto permite a los atacantes ejecutar comandos arbitrarios en el dispositivo, lo que podría provocar acceso no autorizado, interrupción del servicio y exposición de datos.

06 Aug 2025, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-06 21:15

Updated : 2025-08-07 21:26

NVD link : CVE-2025-7769

Mitre link : CVE-2025-7769

CVE.ORG link : CVE-2025-7769

JSON object : View

Products Affected

No product.

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2025-7769", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-08-06T21:15:32.627", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-217-02", "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "Tigo Energy's CCA is vulnerable to a command injection vulnerability in the /cgi-bin/mobile_api endpoint when the DEVICE_PING command is called, allowing remote code execution due to improper handling of user input. When used with default credentials, this enables attackers to execute arbitrary commands on the device that could cause potential unauthorized access, service disruption, and data exposure."}, {"lang": "es", "value": "Tigo Energy's CCA es vulnerable a una vulnerabilidad de inyecci\u00f3n de comandos en el endpoint /cgi-bin/mobile_api al ejecutar el comando DEVICE_PING, lo que permite la ejecuci\u00f3n remota de c\u00f3digo debido al manejo inadecuado de la entrada del usuario. Al usar las credenciales predeterminadas, esto permite a los atacantes ejecutar comandos arbitrarios en el dispositivo, lo que podr\u00eda provocar acceso no autorizado, interrupci\u00f3n del servicio y exposici\u00f3n de datos."}], "lastModified": "2025-08-07T21:26:37.453", "sourceIdentifier": "ics-cert@hq.dhs.gov"}