CVE-2025-43983

Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days.

KuWFi CPF908-CP5 WEB5.0_LCD_20210125 devices have multiple unauthenticated access control vulnerabilities within goform/goform_set_cmd_process and goform/goform_get_cmd_process. These allow an unauthenticated attacker to retrieve sensitive information (including the device admin username and password), modify critical device settings, and send arbitrary SMS messages.

Published 2025-08-14. Last modified 2026-06-17.