MB connect line: Sandbox escape in mbNET's LUA interpreter
view advisory published 2025-07-31
An authenticated remote attacker can exploit an undocumented method to escape the LUA sandbox in mbNET devices, enabling the execution of arbitrary operating system commands and leading to full system compromise.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-41688US | — | — | ||
A high privileged remote attacker can execute arbitrary OS commands using an undocumented method allowing to escape the implemented LUA sandbox. | ||||
02
references
External citations — patches, advisories, analysis.
03
remediations (1)
- Fixed
Update mbNET/mbNET.rokey to at least version 7.3.0\ **Note**: mbNET HW1 is EOL and will not receive any further updates.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan