CVE-2025-10183 - XML External Entity Injection in TecConnect 4.1

Back Back to CVE browser

CRITICAL

XML External Entity Injection in TecConnect 4.1

Published Sep 9, 2025

9.1

CRITICAL

CVSS 3.1

EPSS 0.43%

Description

A blind XML External Entity (XXE) injection in the OpenMessaging webservice in TecCom TecConnect 4.1 allows an unauthenticated attacker to exfiltrate arbitrary files to an attacker-controlled server. TecConnect 4.1 is considered end-of-life as of December 2023. Users are advised to upgrade to TecCom Connect 5.

Affected products

Vendor TecCom Product TecConnect Default
unaffected
- Version
  4.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

TecCom

TecConnect

unaffected

Version	Status	Constraints
4.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-611

XXE

References (1)

https://blog.blacklanternsecurity.com/p/teccom-tecconnect-41-xml-external

Link	Providers	Tags
https://blog.blacklanternsecurity.com/p/teccom-tecconnect-41-xml-external

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner BLSOPS

Published Sep 9, 2025

Updated Sep 9, 2025

Reserved Sep 9, 2025

Link CVE-2025-10183

CISA Vulnrichment

Updated Sep 9, 2025

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2025-10183

Red Hat

Severity n/a

Public date n/a

Links CVE-2025-10183