CVE-2025-64385

Published: Oct 31, 2025Modified: Jun 17, 2026Deferred

9.2

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: 50b5080a-775f-442e-83b5-926b5ca517b6 (Secondary)

Description

The equipment initially can be configured using the manufacturer's application, by Wi-Fi, by the web server or with the manufacturer’s software. Using the manufacturer's software, the device can be configured via UDP. Analyzing this communication, it has been observed that any aspect of the initial configuration can be changed by means of the device's MAC without the need for authentication.

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (3)

https://cds.thalesgroup.com/es/s21sec

Source: 50b5080a-775f-442e-83b5-926b5ca517b6

https://circutor.com/productos/iot-industrial-y-automatizacion/conversores-y-pasarelas/product/D80010./

Source: 50b5080a-775f-442e-83b5-926b5ca517b6

https://www.hackrtu.com/blog/cg-0day-en-003/

Source: 50b5080a-775f-442e-83b5-926b5ca517b6

Timeline

No history available yet.