CVE-2025-63225

critical · 9.8

The Eurolab ELTS100_UBX device (firmware version ELTS100v1.UBX) is vulnerable to Broken Access Control due to missing authentication on critical administrative endpoints. Attackers can directly access and modify sensitive system and network configurations, upload firmware, and execute unauthorized actions without any form of authentication. This vulnerability allows remote attackers to fully compromise the device, control its functionality, and disrupt its operation.

9.8

CVSS

0.6%

EPSS (exploit prob.)

48th

EPSS percentile

2025-11-18

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-284

Affected products

Vendor	Product	Affected versions
eurolab-srl	elts_100_firmware	elts100v1.ubx
eurolab-srl	elts_100	e118

Check a specific version with /api/v1/cve/match.

References

http://eurolab-srl.com/
https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63225_Eurolab_ELTS100_UBX_Broken_Access_Control

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-63225