CVE-2025-11045
Published: 26 September 2025
Summary
CVE-2025-11045 is a medium-severity Injection (CWE-74) vulnerability in Yuque (inferred from references). Its CVSS base score is 5.5 (Medium).
Operationally, ranked in the top 41.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A vulnerability identified as CVE-2025-11045 affects WAYOS LQ_04, LQ_05, LQ_06, LQ_07, and LQ_09 firmware version 22.03.17. It resides in an unspecified function within the file /usb_paswd.asp, where improper handling of the Name argument permits command injection. The issue is tracked under CWE-74 and CWE-77 and carries a CVSS 4.0 score of 5.5, reflecting network-accessible attack conditions without authentication or user interaction.
An unauthenticated remote attacker can supply a crafted Name value to the affected endpoint and execute arbitrary operating-system commands on the device. Public exploit code has been released, enabling straightforward reproduction of the injection sequence over the network.
The listed references point to VulDB entries that document the flaw and related submissions but contain no vendor advisory, patch details, or mitigation guidance.
EPSS for the CVE rose from a low baseline to a peak of 0.0177 on 2025-12-11 before receding, indicating a measurable increase in exploitation interest several months after the September 2025 disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-31388
Vulnerability details
A vulnerability was identified in WAYOS LQ_04, LQ_05, LQ_06, LQ_07 and LQ_09 22.03.17. This affects an unknown function of the file /usb_paswd.asp. The manipulation of the argument Name leads to command injection. The attack can be initiated remotely. The exploit…
more
is publicly available and might be used.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.