Read the docs
TI-2025-24927 Aliases CVE-2025-36729GHSA-mx3f-7vgq-xf97

RACOM M!DGE2 Privilege Escalation via SDK Testing Endpoint

Priority HIGH 67CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

A non-primary administrator user with admin rights to the web interface but without shell access permissions can display configuration of the device including the master admin password. This vulnerability also allows the user to give themselves shell access with the root gid.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00439 38th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
RACOMM!DGE24.0 – 4.6.40.106—No fix listedCNA
  • M!DGE2 VendorRACOM Affected 4.0 – 4.6.40.106 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-36729
  2. 2026-10-03 Alias added: GHSA-mx3f-7vgq-xf97

References

Other 1

  • TI-2021-03378 OS command injection in Racom MIDGE Firmware CVSS 3.1HIGH 8.8
  • TI-2021-03377 Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows for cross-site request forgeries. CVSS 3.1HIGH 8.8
  • TI-2021-03376 Path traversal in Racom MIDGE Firmware CVSS 3.1HIGH 7.2
  • TI-2021-03379 Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows for privilege escalation via configd. CVSS 3.1HIGH 7.8
  • TI-2021-03371 Missing authentication in Racom MIDGE Firmware CVSS 3.1MEDIUM 5.3
  • TI-2021-03375 Cross-site scripting in Racom MIDGE Firmware CVSS 3.1MEDIUM 4.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences