ZeroPath Blog & Research
Explore our team's latest research and stay up to date with ZeroPath's capabilities.
CVE Analysis
•2025-09-09
•8 min read
SIMATIC PCS neo CVE-2025-40795 Stack Buffer Overflow: Brief Summary and Technical Review
CVE-2025-40795 is a critical stack-based buffer overflow in Siemens SIMATIC PCS neo V4.1 and V5.0 and in the User Management Component (UMC) before V2.15.1.3. This post covers the affected versions, the technical root cause, and Siemens' recent security history.
ZeroPath CVE Analysis
CVE Analysis
•2025-09-09
•7 min read
SIMATIC Virtualization as a Service CVE-2025-40804: Brief Summary of Unauthenticated Network Share Exposure
A brief summary of CVE-2025-40804, which affects all versions of Siemens SIMATIC Virtualization as a Service (SIVaaS) and exposes sensitive data through unauthenticated network shares. Covers the technical details, affected versions, and Siemens' security history.
ZeroPath CVE Analysis
CVE Analysis
•2025-09-09
•8 min read
Adobe Commerce CVE-2025-54236 Improper Input Validation: Brief Summary and Technical Review
A brief summary and technical review of CVE-2025-54236, a critical improper input validation vulnerability in Adobe Commerce and Magento. It covers affected versions, technical details, and the vendor's security history, drawing on public sources.
ZeroPath CVE Analysis
CVE Analysis
•2025-09-09
•8 min read
Adobe Acrobat Reader CVE-2025-54257 Use After Free Vulnerability: Brief Summary and Technical Review
A brief summary and technical review of CVE-2025-54257, a Use After Free vulnerability in Adobe Acrobat Reader versions 24.001.30254, 20.005.30774, 25.001.20672 and earlier. A malicious PDF file can use it to achieve arbitrary code execution. The vulnerability has a CVSS score of 7.8. Covers affected versions, the technical mechanism, and references.
ZeroPath CVE Analysis
CVE Analysis
•2025-09-09
•7 min read
Ivanti Connect Secure CVE-2025-55141: Brief Summary of a Critical Missing Authorization Vulnerability
A brief summary of CVE-2025-55141, a critical missing authorization flaw in Ivanti Connect Secure, Policy Secure, ZTA Gateway, and Neurons for Secure Access. It covers the affected versions, the technical root cause, and Ivanti's security history, based on available public information.
ZeroPath CVE Analysis
CVE Analysis
•2025-09-09
•7 min read
Ivanti Connect Secure CVE-2025-55142 Authorization Bypass: Brief Summary and Technical Review
CVE-2025-55142 is a high-severity authorization bypass in Ivanti Connect Secure, Policy Secure, ZTA Gateway, and Neurons for Secure Access. This brief summary covers affected versions, technical details, and Ivanti's security history, based on available public sources.
ZeroPath CVE Analysis
CVE Analysis
•2025-09-09
•7 min read
Ivanti Connect Secure CVE-2025-55145: Brief Summary of Missing Authorization in HTML5 Session Handling
A brief summary of CVE-2025-55145, a missing authorization vulnerability in Ivanti Connect Secure, Policy Secure, ZTA Gateway, and Neurons for Secure Access. It covers the affected versions, how the flaw works, and Ivanti's recent security history, drawn from public information.
ZeroPath CVE Analysis
CVE Analysis
•2025-09-09
•8 min read
Ivanti Connect Secure CSRF Vulnerability (CVE-2025-55147): Brief Summary and Technical Review
CVE-2025-55147 is a high-severity CSRF vulnerability in Ivanti Connect Secure, Policy Secure, ZTA Gateway, and Neurons for Secure Access, fixed in specific newer versions. This post covers how the flaw works, which versions are affected, and Ivanti's recent security history.
ZeroPath CVE Analysis
CVE Analysis
•2025-09-09
•7 min read
Ivanti Connect Secure CVE-2025-55148: Brief Summary of Missing Authorization Vulnerability
CVE-2025-55148 is a missing authorization vulnerability in Ivanti Connect Secure, Policy Secure, ZTA Gateway, and Neurons for Secure Access. This brief summary covers the affected versions, how the flaw works, and Ivanti's recent security history, based on publicly available information.
ZeroPath CVE Analysis
CVE Analysis
•2025-09-09
•8 min read
CoreDNS etcd Plugin TTL Confusion (CVE-2025-58063): Brief Summary and Technical Review
CVE-2025-58063 is a TTL confusion vulnerability in the CoreDNS etcd plugin, affecting versions 1.2.0 up to 1.12.3. This post covers the technical details, the affected versions, and the vendor's security history, with links to the official advisories and technical documentation.
ZeroPath CVE Analysis
CVE Analysis
•2025-09-09
•7 min read
OPEXUS FOIAXpress PAL CVE-2025-58462 SQL Injection: Brief Summary and Technical Details
CVE-2025-58462 is a critical SQL injection vulnerability in OPEXUS FOIAXpress Public Access Link (PAL) before version 11.13.1.0. This post covers the affected versions, the technical details, and the vendor's security history, drawing on available public sources.
ZeroPath CVE Analysis
CVE Analysis
•2025-09-09
•8 min read
Ivanti Endpoint Manager CVE-2025-9712: Brief Summary of Remote Code Execution via Insufficient Filename Validation
A brief summary of CVE-2025-9712 in Ivanti Endpoint Manager, covering the technical details, affected versions, patch information, and Ivanti's recent security history. It does not include a proof of concept or detection methods.
ZeroPath CVE Analysis
CVE Analysis
•2025-09-09
•8 min read
Ivanti Endpoint Manager CVE-2025-9872: Brief Summary of Critical RCE via Filename Validation Flaw
CVE-2025-9872 is a high-severity remote code execution vulnerability in Ivanti Endpoint Manager, caused by insufficient filename validation. This post covers the affected versions, the technical details, the patches, and Ivanti's security history.
ZeroPath CVE Analysis
CVE Analysis
•2025-09-08
•8 min read
Tenda AC20 CVE-2025-10120 Buffer Overflow: Brief Technical Summary
CVE-2025-10120 is a high-severity buffer overflow in Tenda AC20 routers running firmware up to 16.03.08.12. This summary covers the affected versions, the root cause, and Tenda's security history, based on public information.
ZeroPath CVE Analysis
CVE Analysis
•2025-09-08
•8 min read
D-Link DIR-823X Command Injection (CVE-2025-10123): Brief Summary and Technical Review
A brief summary and technical review of CVE-2025-10123, a command injection vulnerability in D-Link DIR-823X routers up to firmware 250416. Remote attackers can execute arbitrary commands by manipulating the Hostname parameter in the /goform/set_static_leases endpoint. No official patch or detection guidance is available at this time.
ZeroPath CVE Analysis
CVE Analysis
•2025-09-08
•7 min read
SAP ABAP Reports CVE-2025-42916 Input Validation Flaw: Brief Summary and Technical Review
CVE-2025-42916 is a missing input validation flaw in SAP ABAP reports. A privileged user can exploit it to delete the contents of arbitrary database tables that are not protected by authorization groups. This summary covers the technical details and the affected systems and versions.
ZeroPath CVE Analysis
CVE Analysis
•2025-09-08
•7 min read
SAP ABAP CVE-2025-42929: Brief Summary of Arbitrary Database Table Deletion via Input Validation Flaw
A brief summary of CVE-2025-42929, a high-severity input validation flaw in SAP ABAP that lets privileged attackers delete the content of arbitrary database tables when authorization groups are not properly configured. Covers technical details, affected versions, and references to SAP advisories.
ZeroPath CVE Analysis
CVE Analysis
•2025-09-08
•7 min read
SAP Business One SLD Credential Exposure (CVE-2025-42933): Brief Summary and Technical Review
A brief summary of CVE-2025-42933 in SAP Business One SLD, where improper encryption in the SLD backend exposes sensitive credentials in HTTP responses. Covers the technical context, affected versions, and SAP's security history, drawn from available sources.
ZeroPath CVE Analysis
CVE Analysis
•2025-09-08
•8 min read
SAP NetWeaver on IBM i-Series: Brief Summary of CVE-2025-42958 Authentication Bypass
A brief summary of CVE-2025-42958, a critical authentication bypass in SAP NetWeaver on IBM i-series. It covers the technical details, affected versions, and vendor history, based on publicly available information.
ZeroPath CVE Analysis
CVE Analysis
•2025-09-08
•9 min read
AutomatorWP CVE-2025-9539: Brief Summary of Critical Unauthorized Automation Import Vulnerability in WordPress
A brief summary of CVE-2025-9539, a high-severity unauthorized automation import vulnerability in AutomatorWP for WordPress. The post covers the technical details, affected versions, and the vendor's security history. It does not include a PoC, a patch, or detection methods.
ZeroPath CVE Analysis
