How severe is CVE-2025-2763?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 6.8 out of 10.

What type of vulnerability is CVE-2025-2763?

This is classified as CWE-347, which is a common weakness in software security.

CVE-2025-2763

MEDIUM Year: 2025

CVSS v3 Score

6.8

Medium

Weakness Type

CWE-347

View all →

Vulnerability Description

CarlinKit CPC200-CCPA Improper Verification of Cryptographic Signature Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of CarlinKit CPC200-CCPA devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of update packages on USB drives. The issue results from the lack of proper verification of a cryptographic signature. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24356.

CVE-2017-11400

MEDIUM

CVSS:6.8(Medium)

An issue has been discovered on the Belden Hirschmann Tofino Xenon Security Appliance before 03.2.00. An incomplete firmware signature allows a local attacker to upgrade the equipment (kernel, file sy...

CWE-3472017

CVE-2020-3209

MEDIUM

CVSS:6.8(Medium)

A vulnerability in software image verification in Cisco IOS XE Software could allow an unauthenticated, physical attacker to install and boot a malicious software image or execute unsigned binaries on...

CWE-3472020

CVE-2021-1453

MEDIUM

CVSS:6.8(Medium)

A vulnerability in the software image verification functionality of Cisco IOS XE Software for the Cisco Catalyst 9000 Family of switches could allow an unauthenticated, physical attacker to execute un...

CWE-3472021

CVE-2021-30066

MEDIUM

CVSS:6.8(Medium)

On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, an arbitrary firmware image can be loaded because firmware s...

CWE-3472021

CVE-2021-35097

MEDIUM

CVSS:6.8(Medium)

Possible authentication bypass due to improper order of signature verification and hashing in the signature verification call in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdrago...

CWE-3472021