CVE-2025-64385

CriticalCVSS 9.2/10Last modified Jun 17, 2026

Description

The equipment initially can be configured using the manufacturer's application, by Wi-Fi, by the web server or with the manufacturer’s software. Using the manufacturer's software, the device can be configured via UDP. Analyzing this communication, it has been observed that any aspect of the initial configuration can be changed by means of the device's MAC without the need for authentication.

Metrics

CVSS 4.0 9.2/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Oct 31, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-643867.7The equipment grants a JWT token for each connection in the timeline, but during an active valid session, a hijacking of the token can be doCVE-2025-643875.1The web application is vulnerable to a so-called ‘clickjacking’ attack. In this type of attack, the vulnerable page is inserted into a page CVE-2025-643889.2Denial of service of the web server through specific requests to this protocolCVE-2025-643898.3The web server of the device performs exchanges of sensitive information in clear text through an insecure protocol.CVE-2025-64399.8The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable toCVE-2025-643907.4A privilege escalation vulnerability exists in PlayStation 4 firmware versions 13.00 through 13.02. The BD-J (Blu-ray Disc Java) sandbox canCVE-2025-643914.1This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locatiCVE-2025-643924.8This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a craftCVE-2025-643939.4This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.CVE-2025-64409.8The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable toCVE-2025-644004.1Control Panel provides an API for pre-registering into an enrollment and organization prior to a user's first login. The API for creating uCVE-2025-644017.5Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a doc