CVE-2025-64305

MediumCVSS 6.5/10Last modified Oct 7, 2026

Description

MicroServer copies parts of the system firmware to an unencrypted external SD card on boot, which contains user and vendor secrets. An attacker can utilize these plaintext secrets to modify the vendor firmware, or gain admin access to the web portal.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-313

Affected software

No affected versions have been published.

Timeline

Published: Jan 7, 2026
Last modified: Oct 7, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-643076.5The Brightpick Internal Logic Control web interface is accessible without requiring user authentication. An unauthorized user could exploit CVE-2025-643086.5The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle to Brightpick AI's documen CVE-2025-643097.4The affected product discloses device telemetry, configuration, and sensitive information via WebSocket traffic to unauthenticated users whe CVE-2025-64316.5When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker cou CVE-2025-643109.8EPSON WebConfig and Epson Web Control for SEIKO EPSON Projector Products do not restrict excessive authentication attempts. An administrativ CVE-2025-643115.5Permission control vulnerability in the Notepad module. Impact: Successful exploitation of this vulnerability may affect service confidentia CVE-2025-643127.5Permission control vulnerability in the file management module. Impact: Successful exploitation of this vulnerability may affect service con CVE-2025-643135.5Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2025-643145.5Permission control vulnerability in the memory management module. Impact: Successful exploitation of this vulnerability may affect confident CVE-2025-643157.1Configuration defect vulnerability in the file management module. Impact: Successful exploitation of this vulnerability may affect app data CVE-2025-643185.3Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Write CVE-2025-643195.3Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeab