CVE-2025-64385

The equipment initially can be configured using the manufacturer's application, by Wi-Fi, by the web server or with the manufacturer’s software. Using the manufacturer's software, the device can be configured via UDP. Analyzing this communication, it has been observed that any aspect of the initial configuration can be changed by means of the device's MAC without the need for authentication.

CVSS

No CVSS.

References

Link	Resource
https://cds.thalesgroup.com/es/s21sec
https://circutor.com/productos/iot-industrial-y-automatizacion/conversores-y-pasarelas/product/D80010./
https://www.hackrtu.com/blog/cg-0day-en-003/

Configurations

No configuration.

History

03 Nov 2025, 16:15

Type	Values Removed	Values Added
References		() https://www.hackrtu.com/blog/cg-0day-en-003/ -

31 Oct 2025, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-10-31 15:15

Updated : 2025-11-04 15:41

NVD link : CVE-2025-64385

Mitre link : CVE-2025-64385

CVE.ORG link : CVE-2025-64385

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2025-64385", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "50b5080a-775f-442e-83b5-926b5ca517b6", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-10-31T15:15:43.527", "references": [{"url": "https://cds.thalesgroup.com/es/s21sec", "source": "50b5080a-775f-442e-83b5-926b5ca517b6"}, {"url": "https://circutor.com/productos/iot-industrial-y-automatizacion/conversores-y-pasarelas/product/D80010./", "source": "50b5080a-775f-442e-83b5-926b5ca517b6"}, {"url": "https://www.hackrtu.com/blog/cg-0day-en-003/", "source": "50b5080a-775f-442e-83b5-926b5ca517b6"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "50b5080a-775f-442e-83b5-926b5ca517b6", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The equipment initially can be configured using the manufacturer's application, by Wi-Fi, by the web server or with the manufacturer\u2019s software.\nUsing the manufacturer's software, the device can be configured via UDP. Analyzing this communication, it has been observed that any aspect of the initial configuration can be changed by means of the device's MAC without the need for authentication."}], "lastModified": "2025-11-04T15:41:31.450", "sourceIdentifier": "50b5080a-775f-442e-83b5-926b5ca517b6"}