CVE-2025-61738

LowCVSS 2.3/10Last modified Oct 19, 2026

Description

Under certain circumstances, attacker can capture the network key, read or write encrypted packets on the PowerG network.

Metrics

CVSS 4.0 2.3/10CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-319

Affected software

VendorProductVersions
Johnson ControlsIQPanel2, IQHub,IQPanel2+,IQPanel 4,PowerG>= IQPanel2, <= 2; IQHub; >= IQPanel2+, <= 2+; >= ,IQPanel 4, <= 4.6.0; >= PowerG, <= 53.02

References

Timeline

Published
Dec 22, 2025
Last modified
Oct 19, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-617397.2Due to Nonce reuse, attackers can perform reply attack or decrypt captured packets.CVE-2025-61746.1The Qwizcards | online quizzes and flashcards WordPress plugin through 3.9.4 does not sanitise and escape the "_stylesheet" parameter beforeCVE-2025-617407.2Authentication issue that does not verify the source of a packet which could allow an attacker to create a denial-of-service condition or moCVE-2025-617483.7Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: LibrariCVE-2025-617492.7Vulnerability in the Unified Audit component of Oracle Database Server. Supported versions that are affected are 23.4-23.9. Easily exploitaCVE-2025-61757.2Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability in DECE Software Geodi allows HTTP Request Splitting. This issueCVE-2025-617504.3Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query). Supported versions that are affecteCVE-2025-617518.1Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (comCVE-2025-617527.5Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected areCVE-2025-617536.1Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Miscellaneous). Supported versions that are affected aCVE-2025-617546.5Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions that are affected areCVE-2025-617553.7Vulnerability in the Oracle GraalVM for JDK product of Oracle Java SE (component: Compiler). Supported versions that are affected are Oracl
CVE-2025-61738: Low severity, CVSS 2.3 | Vulnix