Cyber Resilience

CVE-2025-50753

HighLPE

Published: 26 August 2025

Published
26 August 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0003 9.2th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-50753 is a high-severity Execution with Unnecessary Privileges (CWE-250) vulnerability in Gpt 2741Gnac N2 (inferred from references). Its CVSS base score is 8.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Network Device CLI (T1059.008); ranked at the 9.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as Other Platforms; in the Other ATLAS/OWASP Terms risk domain.

EU & UK References

Vulnerability details

Mitrastar GPT-2741GNAC-N2 devices are provided with access through ssh into a restricted default shell.The command "deviceinfo show file" is supposed to be used from restricted shell to show files and directories. By providing " /bin/sh" (quotes included) to the argument…

more

of this command will drop a root shell.

CWE(s)
CWE-250

AI Security AnalysisAI

AI Category
Other Platforms
Risk Domain
Other ATLAS/OWASP Terms
OWASP Top 10 for LLMs 2025
None mapped
Classification Reason
Matched keywords: gpt

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

The vulnerability enables escaping a restricted shell to spawn a root shell via the 'deviceinfo show file "/bin/sh"' CLI command over SSH on a network device, facilitating Network Device CLI abuse for execution (T1059.008) and exploitation for privilege escalation (T1068).

Affected Assets

Gpt 2741Gnac N2
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-1 Policy and Procedures
addresses: CWE-250

Policy promotes least privilege by defining necessary privileges and management commitment to them.

AC-13 Supervision and Review — Access Control
addresses: CWE-250

Supervision detects and allows removal of unnecessary privileges that enable execution with excess rights.

AC-2 Account Management
addresses: CWE-250

Reviewing accounts for compliance, disabling/removing unneeded accounts, and aligning with termination processes prevents execution with unnecessary privileges.

AC-5 Separation of Duties
addresses: CWE-250

Separation of duties prevents any single user from holding all privileges needed to complete a critical task, directly reducing execution with unnecessary privileges.

AC-6 Least Privilege
addresses: CWE-250

Directly prevents execution with more privileges than needed for assigned tasks.

AT-3 Role-based Training
addresses: CWE-250

Role-based training on least privilege principles reduces the chance personnel assign or retain unnecessary privileges.

AU-6 Audit Record Review, Analysis, and Reporting
addresses: CWE-250

Analysis of audit records can identify execution with unnecessary privileges through unusual activity patterns.

CA-9 Internal System Connections
addresses: CWE-250

Automatic termination after a defined period eliminates unnecessary privileges from persistent connections.

References