CarlinKit CPC200-CCPA Wireless Hotspot Hard-Coded Credentials Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of CarlinKit CPC200-CCPA devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the configuration of the wireless hotspot. The issue results from the use of hard-coded credentials. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-24349.
References
| Link | Resource |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-25-177/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
11 Jul 2025, 14:01
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| First Time |
Carlinkit autokit
Carlinkit Carlinkit cpc200-ccpa |
|
| References | () https://www.zerodayinitiative.com/advisories/ZDI-25-177/ - Third Party Advisory | |
| CPE | cpe:2.3:h:carlinkit:cpc200-ccpa:*:*:*:*:*:*:*:* cpe:2.3:a:carlinkit:autokit:2024.01.19.1541:*:*:*:*:*:*:* |
23 Apr 2025, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-04-23 17:16
Updated : 2025-07-11 14:01
NVD link : CVE-2025-2765
Mitre link : CVE-2025-2765
JSON object : View
Products Affected
carlinkit
- autokit
- cpc200-ccpa
CWE
CWE-798
Use of Hard-coded Credentials