CVE-2025-29270

10.0 criticalEPSS 0.4%

Critical (10.0). EPSS 0.4% chance of exploitation in the next 30 days.

Incorrect access control in the realtime.cgi endpoint of Deep Sea Electronics devices DSE855 v1.1.0 to v1.1.26 allows attackers to gain access to the admin panel and complete control of the device.

Severity

CVSS 3.1

10.0 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 29% of CVEs (scores of 2026-10-31)
CWEs: CWE-200, CWE-284
Published: 2025-10-31
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://blog.byteray.co.uk/shadow-entry-discovery-of-authentication-bypass-vulnerability-in-dse855-communications-device-938e35d4b361

Check your stack JSON