CVE-2025-6839
Published: 29 June 2025
Summary
CVE-2025-6839 is a low-severity Hidden Functionality (CWE-912) vulnerability in Wetolink (inferred from references). Its CVSS base score is 2.1 (Low).
Operationally, ranked at the 44.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-19468
Vulnerability details
A vulnerability, which was classified as critical, has been found in Conjure Position Department Service Quality Evaluation System up to 1.0.11. Affected by this issue is the function eval of the file public/assets/less/bootstrap-less/mixins/head.php. The manipulation of the argument payload leads…
more
to backdoor. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Documenting every system component at the required granularity and reviewing the inventory detects or prevents hidden functionality from remaining undetected.
Recovery eliminates hidden functionality or backdoors introduced during compromise.
Policy requires supplier transparency and testing to detect hidden functionality or backdoors inserted in the supply chain.
Screening high-risk technical positions lowers the probability that hidden functionality or backdoors will be added by authorized personnel.
Hunting identifies hidden functionality used for persistence or evasion after initial compromise.
TSCM surveys discover and eliminate hidden surveillance functionality that would otherwise remain undetected in the environment.
Change control, approval gates, and flaw tracking force hidden functionality to be either documented or discovered and removed.
Vetting and integrity controls during acquisition reduce the likelihood of hidden backdoors or malicious functionality introduced by suppliers.