i-Drive i11/i12 Device Setting improper access control for register interface

published 2025-03-03 20 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-5513

cvss: 5.0; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 11%
public exploits: 0; none known

A vulnerability was found in i-Drive i11 and i12 up to 20250227. It has been rated as critical. Affected by this issue is some unknown functionality of the component Device Setting Handler. The manipulation leads to improper access control for register interface. The attack needs to be done within the local network. The complexity of an attack is rather high. The exploitation is known to be difficult. It was not possible to identify the current maintainer of the product. It must be assumed that the product is end-of-life.

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 20 mo ago (2025-03-04)

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	2.3	CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CNA	3.1	5.0	CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CNA	3.0	5.0	CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CNA	2.0	4.3	AV:A/AC:H/Au:N/C:P/I:P/A:P
CNA	4.0	2.3	CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	7.0	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

i-Drive i11
i-Drive i12

Classification

Weakness

CWE-1262 Improper Access Control for Register Interface
CWE-284 Improper Access Control

References

vuldb.com /?id.298196
vdb-entry, permissions-required
vuldb.com /?ctiid.298196
signature, permissions-required
vuldb.com /?submit.510955
third-party-advisory
github.com /geo-chen/i-Drive
related, third-party-advisory

Sources

CVE List CVE-2025-1882
NVD CVE-2025-1882

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary