Helmholz: Sandbox escape in REX200/250 LUA interpreter
view advisory published 2025-07-31
An authenticated remote attacker can exploit an undocumented method to escape the LUA sandbox in REX200/250 devices, enabling the execution of arbitrary operating system commands and leading to full system compromise.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-41688US | — | — | ||
A high privileged remote attacker can execute arbitrary OS commands using an undocumented method allowing to escape the implemented LUA sandbox. | ||||
02
references
External citations — patches, advisories, analysis.
03
remediations (1)
- Fixed
Update REX 200/250 to at least version 7.3.0\ **Note**: REX 300 is EOL and will not receive any further updates.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan