CVEvulnerability

CVE-2025-64385

9.2 CRITICAL Published 2025-10-31 Modified 2026-06-17 Official page ↗
Status
Deferred
Published
2025-10-31
Last modified
2026-06-17
Assigner
50b5080a-775f-442e-83b5-926b5ca517b6
CVSS 4.0 (50b5080a-775f-442e-83b5-926b5ca517b6)
9.2 CRITICAL — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weaknesses
CWE-20

Description

The equipment initially can be configured using the manufacturer's application, by Wi-Fi, by the web server or with the manufacturer’s software. Using the manufacturer's software, the device can be configured via UDP. Analyzing this communication, it has been observed that any aspect of the initial configuration can be changed by means of the device's MAC without the need for authentication.

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References