CVE-2025-43983

9.1 criticalEPSS 0.4%

Critical (9.1). EPSS 0.4% chance of exploitation in the next 30 days.

KuWFi CPF908-CP5 WEB5.0_LCD_20210125 devices have multiple unauthenticated access control vulnerabilities within goform/goform_set_cmd_process and goform/goform_get_cmd_process. These allow an unauthenticated attacker to retrieve sensitive information (including the device admin username and password), modify critical device settings, and send arbitrary SMS messages.

Severity

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 34% of CVEs (scores of 2026-10-31)
CWE: CWE-306
Published: 2025-08-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://drive.proton.me/urls/CN629YJ3F4#NUgX6IB4clos
https://github.com/actuator/cve/blob/main/Kuwfi/CVE-2025-43983.txt
https://github.com/actuator/cve/tree/main/KuWfi

Check your stack JSON