CVE-2025-29270CRITICAL 10.0EPSS p26.3%

CVE-2025-29270CVE-2025-29270

Description

Incorrect access control in the realtime.cgi endpoint of Deep Sea Electronics devices DSE855 v1.1.0 to v1.1.26 allows attackers to gain access to the admin panel and complete control of the device.

Scoring

CVSS 3.110.0 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS0.34% probability of exploitation · percentile 26.3% · 2026-08-03T12:00:16Z
Published2025-10-31
Last modified2026-04-15

Underlying weaknesses· 2

CWE-200CWE-284

References

  1. https://blog.byteray.co.uk/shadow-entry-discovery-of-authentication-bypass-vulnerability-in-dse855-communications-device-938e35d4b361

2

TypeTargetConfidenceTier
WeaknessExposure of Sensitive Information to an Unauthorized Actorcwe-2000%live
WeaknessImproper Access Controlcwe-2840%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-22968
CVE
CVE-2026-40425
CVE
CVE-2025-59817
CVE
CVE-2026-20761
CVE
D-Link DIR-825 R1 Devices Buffer Overflow Vulnerability
CVE
CVE-2025-28202
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.