Log in Start free

Vulnerability · Published May 19, 2025 · Assigned by VulDB

CVE-2025-4905iop-apl-uw basestation3 QC.py load_qc_pickl deserialization

Medium 5.3

In plain English

A medium-severity unsafe deserialization in basestation3 from iop-apl-uw. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.5%top 55.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in iop-apl-uw basestation3 up to 3.0.4 and classified as problematic. This issue affects the function load_qc_pickl of the file basestation3/QC.py. The manipulation of the argument qc_file leads to deserialization. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The code maintainer tagged the issue as closed. But there is no new commit nor release in the GitHub repository available so far.

Affected products (as reported)

VendorProductVersions
iop-apl-uw basestation3 3.0.03.0.13.0.23.0.33.0.4

Weakness: CWE-502, CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References