CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2025-41753 — The object name of a dynamically created BACnet File Object is interpreted as a ...

·Source: NIST NVD

Updated:

Executive Summary

The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the device, which may lead to full system compromise.

Analysis

The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the device, which may lead to full system compromise. CVSS Score: 9.8. Published: 2026-10-01T07:16:32.473.

Indicators of Compromise (1)

CVE (1)
CVE-2025-41753
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Oct 1, 2026. Verified by: NIST.

Related Threats

LOWVulnerabilityNEW

The Fine Art of Frustrating the Adversary

What really frustrates an adversary? Eight Cisco Talos researchers share practical ways to make their next move slower and riskier. From deception and behavioral detection to breaking attack dependencies and resisting manufactured urgency.

Cisco Talos
MEDIUMVulnerabilityNEW

Hackers stole Pentagon personnel records of over 3 million people

The Pentagon's Defense Manpower Data Center (DMDC) is notifying millions of military service members that hackers stole their data after breaching the Pentagon's human resources management system in October 2025. [...]

BleepingComputer
MEDIUMVulnerability

AI Threats Top Cybersecurity Preparedness Gap, PwC Finds

PwC finds global security leaders are most concerned about attacks on AI systems

Infosecurity Magazine