CVE-2025-62775 Auth bypass in M6a
Attackers can gain root access to Mercku M6a devices by using the web admin password for TELNET login.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-62775?
CVE-2025-62775 is a high-severity authentication bypass vulnerability in Mercku M6a, published on 22 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Mercku M6a devices through 2.1.0 allow root TELNET logins via the web admin password.
Weakness: CWE-669
Which versions are affected by CVE-2025-62775?
How do I fix CVE-2025-62775?
No fix has been published for CVE-2025-62775 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-62775 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-62775 exists.
Sources
Also known as GHSA-ww5c-h42x-mc5x.