CVE-2025-67397

Name of the Vulnerable Software and Affected Versions Passy version 1.6.3

Description A flaw exists in Passy that could allow a remote attacker to execute arbitrary commands. This can occur through the serial interface by sending a specific code sequence. Additionally, a remote authenticated attacker can achieve the same outcome by sending a crafted HTTP request with a specific payload.

Recommendations Update to a newer version of Passy that addresses this issue. As a temporary workaround, restrict access to the serial interface. As a temporary workaround, carefully validate all HTTP request payloads to prevent payload injection.