CVE-2025-0681

MediumCVSS 6.2/10Last modified Jun 17, 2026

Description

The Cloud MQTT service of the affected products supports wildcard topic subscription which could allow an attacker to obtain sensitive information from tapping the service communications.

Metrics

CVSS 3.1 6.2/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-155

Affected software

VendorProductVersions
New Rock TechnologiesOM500 IP-PBXAll
New Rock TechnologiesMX8G VoIP GatewayAll
New Rock TechnologiesNRP1302/P Desktop IP PhoneAll

References

Timeline

Published
Jan 30, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-06828.8The ThemeREX Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.0 via the 'trx_sc_CVE-2025-06835.9In its default configuration, Contec Health CMS8000 Patient Monitor transmits plain-text patient data to a hard-coded public IP address wheCVE-2025-06846.4A flaw was found in grub2. When performing a symlink lookup from a reiserfs filesystem, grub's reiserfs fs module uses user-controlled paramCVE-2025-06856.4A flaw was found in grub2. When reading data from a jfs filesystem, grub's jfs filesystem module uses user-controlled parameters from the fiCVE-2025-06866.4A flaw was found in grub2. When performing a symlink lookup from a romfs filesystem, grub's romfs filesystem module uses user-controlled parCVE-2025-06876.1The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before oCVE-2025-06886.1The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before oCVE-2025-06897.8When reading data from disk, the grub's UDF filesystem module utilizes the user controlled data length metadata to allocate its internal bufCVE-2025-06906.1The read command is used to read the keyboard input from the user, while reads it keeps the input length in a 32-bit integer value which is CVE-2025-06915.0Improper access control in permissions component in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the "ECVE-2025-06923.5The Simple Video Management System WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high CVE-2025-06935.3Variable response times in the AWS Sign-in IAM user login flow allowed for the use of brute force enumeration techniques to identify valid I
CVE-2025-0681: Medium severity, CVSS 6.2 | Vulnix