CVE-2025-70085 - Vulnerability Analysis

Overview

OpenSatKit 2.2.1 contains a stack buffer overflow caused by unsafe sprintf usage without length checks in EventErrStr buffer in file.c, letting attackers cause memory corruption, exploit requires crafted input filenames.

Severity & Score

Impact

Attackers can cause memory corruption leading to potential code execution or application crash.

Mitigation

Update to a version that uses bounded format specifiers or apply patches to validate buffer lengths.

References

• https://gist.github.com/jonafk555
• https://github.com/OpenSatKit/OpenSatKit
• https://github.com/OpenSatKit/OpenSatKit/releases/tag/v2.2.1
• https://raw.githubusercontent.com/OpenSatKit/OpenSatKit/master/cfs/apps/filemgr/fsw/src/file.c

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 13, 2026

🔴 CVE-2025-70085 - Critical (9.8) An issue was discovered in OpenSatKit 2.2.1. The EventErrStr buffer has a fixed size of 256 bytes. The code uses sprintf to format two filenames (Source1Filename and the string returned by FileUtil_FileStateStr) into this buffer without any length... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-70085/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner