Carlinkit CPC200-CCPA
Approved changes feed: RSS · Atom
cpe:2.3:h:carlinkit:cpc200-ccpa:-:*:*:*:*:*:*:*
part: h version: - update: *
| Vendor | Carlinkit (2ab39016-3a35-55c4-909b-15fe8266c687) |
|---|---|
| Product | Cpc200 Ccpa (1ad743f4-d5c3-5326-8ca7-3be1a4bc89df) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-2764 |
not_vulnerable | 2026-06-08 07:16:58.200616 |
CarlinKit CPC200-CCPA update.cgi Improper Verification of Cryptographic Signature Code Execution Vulnerability
HIGH (8)
CarlinKit CPC200-CCPA update.cgi Improper Verification of Cryptographic Signature Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of CarlinKit CPC200-CCPA devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.
The specific flaw exists within the handling of update packages provided to update.cgi. The issue results from the lack of proper verification of a cryptographic signature. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24355.
Published: 2025-04-23T16:48:43.116Z
Updated: 2025-04-23T18:08:36.195Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-2763 |
not_vulnerable | 2026-06-08 07:16:58.200184 |
CarlinKit CPC200-CCPA Improper Verification of Cryptographic Signature Code Execution Vulnerability
MEDIUM (6.8)
CarlinKit CPC200-CCPA Improper Verification of Cryptographic Signature Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of CarlinKit CPC200-CCPA devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of update packages on USB drives. The issue results from the lack of proper verification of a cryptographic signature. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24356.
Published: 2025-04-23T16:48:00.717Z
Updated: 2025-04-23T18:14:09.276Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-2762 |
not_vulnerable | 2026-06-08 07:16:58.199714 |
CarlinKit CPC200-CCPA Missing Root of Trust Local Privilege Escalation Vulnerability
HIGH (7.8)
CarlinKit CPC200-CCPA Missing Root of Trust Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of CarlinKit CPC200-CCPA devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the configuration of the application system-on-chip (SoC). The issue results from the lack of a properly configured hardware root of trust. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the boot process. Was ZDI-CAN-25948.
Published: 2025-04-23T16:47:46.789Z
Updated: 2025-04-23T18:20:33.799Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.