CVE-2025-64309

HighCVSS 7.4/10Last modified Oct 18, 2026

Description

The affected product discloses device telemetry, configuration, and sensitive information via WebSocket traffic to unauthenticated users when they connect to a specific URL. The unauthenticated URL can be discovered through basic network scanning techniques.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-523

Affected software

No affected versions have been published.

Timeline

Published: Nov 15, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-64316.5When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker cou CVE-2025-643109.8EPSON WebConfig and Epson Web Control for SEIKO EPSON Projector Products do not restrict excessive authentication attempts. An administrativ CVE-2025-643115.5Permission control vulnerability in the Notepad module. Impact: Successful exploitation of this vulnerability may affect service confidentia CVE-2025-643127.5Permission control vulnerability in the file management module. Impact: Successful exploitation of this vulnerability may affect service con CVE-2025-643135.5Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2025-643145.5Permission control vulnerability in the memory management module. Impact: Successful exploitation of this vulnerability may affect confident CVE-2025-643157.1Configuration defect vulnerability in the file management module. Impact: Successful exploitation of this vulnerability may affect app data CVE-2025-643185.3Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Write CVE-2025-643195.3Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeab CVE-2025-64328.6When Multi-Account Containers was enabled, DNS requests could have bypassed a SOCKS proxy when the domain name was invalid or the SOCKS prox CVE-2025-643206.5Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Code Injection.This is CVE-2025-643215.3Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable