CVEvulnerability

CVE-2025-54807

9.3 CRITICAL Published 2025-09-18 Modified 2026-10-18 Official page ↗
Status
Deferred
Published
2025-09-18
Last modified
2026-10-18
Assigner
[email protected]
CVSS 4.0 ([email protected])
9.3 CRITICAL — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-321

Description

The secret used for validating authentication tokens is hardcoded in device firmware for affected versions. An attacker who obtains the signing key can bypass authentication, gaining complete access to the system.

Related

Weakness · CWE (1)

  • CWE-321 Use of Hard-coded Cryptographic Key weakness

References