CVE-2025-0681

MediumCVSS 6.2/10Last modified Jun 17, 2026

Description

The Cloud MQTT service of the affected products supports wildcard topic subscription which could allow an attacker to obtain sensitive information from tapping the service communications.

Metrics

CVSS 3.1 6.2/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-155

Affected software

No affected versions have been published.

Timeline

Published: Jan 30, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-06828.8The ThemeREX Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.0 via the 'trx_sc_CVE-2025-06835.9In its default configuration, Contec Health CMS8000 Patient Monitor transmits plain-text patient data to a hard-coded public IP address whe CVE-2025-06846.4A flaw was found in grub2. When performing a symlink lookup from a reiserfs filesystem, grub's reiserfs fs module uses user-controlled param CVE-2025-06856.4A flaw was found in grub2. When reading data from a jfs filesystem, grub's jfs filesystem module uses user-controlled parameters from the fi CVE-2025-06866.4A flaw was found in grub2. When performing a symlink lookup from a romfs filesystem, grub's romfs filesystem module uses user-controlled par CVE-2025-06876.1The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before o CVE-2025-06886.1The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before o CVE-2025-06897.8When reading data from disk, the grub's UDF filesystem module utilizes the user controlled data length metadata to allocate its internal buf CVE-2025-06906.1The read command is used to read the keyboard input from the user, while reads it keeps the input length in a 32-bit integer value which is CVE-2025-06915.0Improper access control in permissions component in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the "E CVE-2025-06923.5The Simple Video Management System WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high CVE-2025-06935.3Variable response times in the AWS Sign-in IAM user login flow allowed for the use of brute force enumeration techniques to identify valid I