Threat Investigation
Request a demo

CVE-2025-46612

High

Description

The Panel Designer dashboard in Airleader Master and Easy before 6.36 allows remote attackers to execute arbitrary commands via a wizard/workspace.jsp unrestricted file upload. To exploit this, the attacker must login to the administrator console (default credentials are weak and easily guessable) and upload a JSP file via the Panel Designer dashboard.

SeverityHigh
CVSS7.2
Exploit probability—
ProductAirleader Easy Firmware
PublishedJun 10, 2025
First seenJun 10, 2025
Weakness typeCWE-434Unrestricted upload of dangerous file type

How to fix

Update
  • airleader easy_firmware6.36 or later
  • airleader master_ii\+_firmware6.36 or later

Affected products

ProductAffected versionsFixed in
airleader easy_firmwarev < 6.366.36
airleader master_ii\+_firmwarev < 6.366.36

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.