PT-2025-6971

Name of the Vulnerable Software and Affected Versions: GatesAir Maxiva UAXT, VAXT transmitters affected versions not specified Description: A critical remote code execution issue exists in the web-based management interface of the affected transmitters when debugging mode is enabled. An attacker...

GatesAir Maxiva security vulnerabilities

GatesAir Maxiva is a series of transmitters from GatesAir USA. A security vulnerability exists in the GatesAir Maxiva UAXT Transmitter and VAXT Transmitter that stems from improperly validated POST request processing when debug mode is enabled, resulting in remote code execution...

CVE-2025-22962: Improper Neutralization of Special Elements used in a Command

A critical remote code execution RCE vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters when debugging mode is enabled. An attacker with a valid session ID sessid can send specially crafted POST requests to the /json endpoint, enabling arbitrary...

CVE-2025-22961: Exposure of Sensitive Information to an Unauthorized Actor

A critical information disclosure vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters due to Incorrect Access Control CWE-284. Unauthenticated attackers can directly access sensitive database backup files snapshotusers.db via publicly exposed URLs...