CVE-2025-23406

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Out-of-bounds read vulnerability caused by improper checking of TCP MSS option values exists in Cente middleware TCP/IP Network Series, which may lead to processing a specially crafted packet to cause the affected product crashed.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
DMG MORI Digital Co., LTD. and NXTech Co., Ltd.	Cente TCP/IPv4	Ver.1.51 and earlier
DMG MORI Digital Co., LTD. and NXTech Co., Ltd.	Cente TCP/IPv4 SNMPv2	Ver.2.30 and earlier
DMG MORI Digital Co., LTD. and NXTech Co., Ltd.	Cente TCP/IPv4 SNMPv3	Ver.2.30 and earlier
DMG MORI Digital Co., LTD. and NXTech Co., Ltd.	Cente IPv6	Ver.1.60 and earlier
DMG MORI Digital Co., LTD. and NXTech Co., Ltd.	Cente IPv6 SNMPv2	Ver.2.30 and earlier
DMG MORI Digital Co., LTD. and NXTech Co., Ltd.	Cente IPv6 SNMPv3	Ver.2.30 and earlier

References

Timeline

Published: Feb 14, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-234074.3Incorrect privilege assignment vulnerability in the WEB UI (the setting page) exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a CVE-2025-234086.5Weak Password Requirements vulnerability in Apache Fineract. This issue affects Apache Fineract: through 1.10.1. The issue is fixed in vers CVE-2025-234097.8in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This CVE-2025-23413.1A vulnerability was found in IROAD Dash Cam X5 up to 20250203. It has been rated as problematic. This issue affects some unknown processing CVE-2025-234109.8When uploading organism or sequence data via the web interface, GMOD Apollo will unzip and inspect the files and will not check for path CVE-2025-234116.5mySCADA myPRO Manager is vulnerable to cross-site request forgery (CSRF), which could allow an attacker to obtain sensitive information. A CVE-2025-234127.5When BIG-IP APM Access Profile is configured on a virtual server, undisclosed request can cause TMM to terminate. Note: Software vers CVE-2025-234134.4When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sensitive information in the pgau CVE-2025-234147.8in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This CVE-2025-234153.1An insufficient verification of data authenticity vulnerability exists in BIG-IP APM Access Policy endpoint inspection that may allow an att CVE-2025-234164.9Path traversal may lead to arbitrary file deletion. The score without least privilege principle violation is as calculated below. In combi CVE-2025-234177.5A denial of service vulnerability exists in the Modbus RTU over TCP functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted