Cyber Resilience

CVE-2025-48416

High

Published: 21 May 2025

Published
21 May 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0031 54.2th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-48416 is a high-severity Hidden Functionality (CWE-912) vulnerability in Sec Consult (inferred from references). Its CVSS base score is 8.1 (High).

Operationally, ranked in the top 45.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

An OpenSSH daemon listens on TCP port 22. There is a hard-coded entry in the "/etc/shadow" file in the firmware image for the "root" user. However, in the default SSH configuration the "PermitRootLogin" is disabled, preventing the root user from…

more

logging in via SSH. This configuration can be bypassed/changed by an attacker through multiple paths though.

CWE(s)
CWE-912

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

Sec Consult
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CM-8 System Component Inventory
addresses: CWE-912

Documenting every system component at the required granularity and reviewing the inventory detects or prevents hidden functionality from remaining undetected.

CP-10 System Recovery and Reconstitution
addresses: CWE-912

Recovery eliminates hidden functionality or backdoors introduced during compromise.

PM-30 Supply Chain Risk Management Strategy
addresses: CWE-912

Policy requires supplier transparency and testing to detect hidden functionality or backdoors inserted in the supply chain.

PS-2 Position Risk Designation
addresses: CWE-912

Screening high-risk technical positions lowers the probability that hidden functionality or backdoors will be added by authorized personnel.

RA-10 Threat Hunting
addresses: CWE-912

Hunting identifies hidden functionality used for persistence or evasion after initial compromise.

RA-6 Technical Surveillance Countermeasures Survey
addresses: CWE-912

TSCM surveys discover and eliminate hidden surveillance functionality that would otherwise remain undetected in the environment.

SA-10 Developer Configuration Management
addresses: CWE-912

Change control, approval gates, and flaw tracking force hidden functionality to be either documented or discovered and removed.

SA-12 Supply Chain Protection
addresses: CWE-912

Vetting and integrity controls during acquisition reduce the likelihood of hidden backdoors or malicious functionality introduced by suppliers.

References