CVE-2025-2762 – CarlinKit CPC200-CCPA Root of Trust Failure Privilege Escalation Vulnerability

April 23, 2025

CVE ID : CVE-2025-2762

Published : April 23, 2025, 5:16 p.m. | 1 hour, 42 minutes ago

Description : CarlinKit CPC200-CCPA Missing Root of Trust Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of CarlinKit CPC200-CCPA devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the configuration of the application system-on-chip (SoC). The issue results from the lack of a properly configured hardware root of trust. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the boot process. Was ZDI-CAN-25948.

Severity: 7.8 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Source: Read More

Previous ArticleCVE-2025-2765 – CarlinKit CPC200-CCPA Hard-Coded Credentials Authentication Bypass

Next Article CVE-2025-2763 – CarlinKit CPC200-CCPA Cryptographic Signature Verification Bypass Code Execution Vulnerability

Highlights

CVE-2025-4532 – Shanghai Bairui Information Technology SunloginClient DLL Search Path Vulnerability (Uncontrolled Search Path)

May 11, 2025

CVE ID : CVE-2025-4532

Published : May 11, 2025, 6:15 a.m. | 23 minutes ago

Description : A vulnerability classified as critical has been found in Shanghai Bairui Information Technology SunloginClient 15.8.3.19819. This affects an unknown part in the library process.dll of the file sunlogin_guard.exe. The manipulation leads to uncontrolled search path. Local access is required to approach this attack. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Severity: 7.0 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

This week in AI dev tools: Gemini 2.5 Pro and Flash GA, GitHub Copilot Spaces, and more (June 20, 2025)

Gemini 2.5 Pro and Flash are generally available and Gemini 2.5 Flash-Lite preview is announced

CSS Cascade Layers Vs. BEM Vs. Utility Classes: Specificity Control

IBM launches new integration to help unify AI security and governance

One of World of Warcraft’s deadliest entities makes a world-shattering return after nearly 20 years — and he’s city-sized

It feels like Blizzard has abandoned Diablo 2: Resurrected — but there’s one way to keep it alive for years to come

Steam’s performance tracking tool is becoming more like the Steam Deck’s — you can try it out right now

Borderlands 4 is killing off a tired “FOMO” trend — I hope other developers follow suit

Dr. Axel’s JavaScript flashcards

Dr. Axel’s JavaScript flashcards

Syntax-Highlight – Custom Element For Syntax Highlighting Content

WelsonJS – Build a Windows app on the Windows built-in JavaScript engine

One of World of Warcraft’s deadliest entities makes a world-shattering return after nearly 20 years — and he’s city-sized

One of World of Warcraft’s deadliest entities makes a world-shattering return after nearly 20 years — and he’s city-sized

It feels like Blizzard has abandoned Diablo 2: Resurrected — but there’s one way to keep it alive for years to come

Steam’s performance tracking tool is becoming more like the Steam Deck’s — you can try it out right now

CVE-2025-2762 – CarlinKit CPC200-CCPA Root of Trust Failure Privilege Escalation Vulnerability

CVE-2025-49763: Apache Traffic Server Vulnerability Enables Memory Exhaustion Attacks

IBM QRadar SIEM Exposed by Trio of Security Flaws, Including Critical Command Execution Bug

CVE-2025-3970 – Baseweb JSite Cross-Site Scripting Vulnerability

Microsoft says Copilot can use location to change Outlook’s UI on Android

CVE-2025-4025 – iSourcecode Placement Management System SQL Injection

SVAR Svelte Filter: Visual Query Builder for Data-Driven Apps

CVE-2025-4532 – Shanghai Bairui Information Technology SunloginClient DLL Search Path Vulnerability (Uncontrolled Search Path)

CVE-2025-30641 – Trend Micro Deep Security Local Privilege Escalation Vulnerability

ManageEngine Exchange Reporter Plus Vulnerability Allows Remote Code Execution

CISA Warns of Active Exploitation of Linux Kernel Privilege Escalation Vulnerability

CVE-2025-2762 – CarlinKit CPC200-CCPA Root of Trust Failure Privilege Escalation Vulnerability

Related Posts