CVE-2025-67158 describes an authentication bypass vulnerability in the Revotech I6032W-FHW device, specifically in the /cgi-bin/jvsweb.cgi endpoint of version 1.0.0014. The vulnerability enables unauthenticated attackers to bypass authentication controls, potentially accessing sensitive information and escalating privileges through crafted HTTP requests. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. There is no vendor advisory or patch information available at this time.

Successful exploitation allows an unauthenticated attacker to bypass authentication mechanisms, gaining unauthorized access to sensitive information and potentially escalating privileges on the affected device. The confidentiality impact is high, but integrity and availability are not impacted according to the CVSS vector. This could lead to exposure of sensitive data and unauthorized control over device functions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected endpoint and monitor for suspicious HTTP requests targeting /cgi-bin/jvsweb.cgi. Avoid exposing the device directly to untrusted networks.