Emoncms 11.7.3 Firmware Upload upload-custom-firmware filename/port/baud_rate/core/autoreset input validation

Summaryinfo

A vulnerability, which was classified as critical, has been found in Emoncms 11.7.3. Impacted is an unknown function of the file /admin/upload-custom-firmware of the component Firmware Upload Handler. This manipulation of the argument filename/port/baud_rate/core/autoreset causes Remote Privilege Escalation. This vulnerability is registered as CVE-2025-60938. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in Emoncms 11.7.3. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/upload-custom-firmware of the component Firmware Upload Handler. The manipulation of the argument filename/port/baud_rate/core/autoreset with an unknown input leads to a remote privilege escalation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Emoncms 11.7.3 has a remote code execution vulnerability in the firmware upload feature that allows authenticated users to execute arbitrary commands on the target system. The vulnerability stems from insufficient input validation of user-controlled parameters including filename, port, baud_rate, core, and autoreset within the /admin/upload-custom-firmware endpoint.

The advisory is shared at github.com. This vulnerability is known as CVE-2025-60938 since 09/26/2025. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/24/2025).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-35852). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Emoncms

Version

• 11.7.3

Website

• Product: https://github.com/emoncms/emoncms/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion