UCHIDA YOKO wivia 5 Vulnerabilities: RCE, XSS, Auth Bypass (CVE-2025-41385/41406/47697)

Critical Vulnerability Information Vulnerability Overview Product: wivia 5 (provided by UCHIDA YOKO CO., LTD.) Vulnerability Type: Multiple vulnerabilities Affected Products All versions of wivia 5 Description wivia 5 is affected by the following vulnerabilities: OS Command Injection (CWE-78) - CVSS 4.0: AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 7.1 - CVSS 3.0: AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H Base Score 6.7 - CVE-2025-41385 Cross-site Scripting (CWE-79) - CVSS 4.0: AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N Base Score 5.1 - CVSS 3.0: AV:N/AC:L/PR:L/UI:R/S:C/L/E:A/N Base Score 5.4 - CVE-2025-41406 Client-Side Enforcement of Server-Side Security (CWE-602) - CVSS 4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Base Score 6.9 - CVSS 3.0: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:E/A:N Base Score 6.5 - CVE-2025-47697 Impact Logged-in administrator users may execute arbitrary OS commands (CVE-2025-41385) When users connect to the affected device and perform specific actions, arbitrary scripts may be executed in the auditor's web browser (CVE-2025-41406) Unauthenticated attackers may bypass authentication and operate the affected device as an auditor (CVE-2025-47697) Solution Discontinue use of the affected product; migration to the successor product "wivia R+" is recommended Vendor Status Vendor: UCHIDA YOKO CO., LTD. Status: Vulnerable Last Updated: 2025/05/30 Vendor Note: UCHIDA YOKO CO., LTD. website References JPCERT/CC Addendum JPCERT/CC Vulnerability Analysis Additional Information CVE IDs: - CVE-2025-41385 - CVE-2025-41406 - CVE-2025-47697 JVN iPedia: JVNDB-2025-000034

Goal Reached Thanks to every supporter — we hit 100%!

UCHIDA YOKO wivia 5 Vulnerabilities: RCE, XSS, Auth Bypass (CVE-2025-41385/41406/47697)