CVE-2025-47872 | THREATINT

Description

The public-facing product registration endpoint server responds differently depending on whether the S/N is valid and unregistered, valid but already registered, or does not exist in the database. Combined with the fact that serial numbers are sequentially assigned, this allows an attacker to gain information on the product registration status of different S/Ns.

PUBLISHED Reserved 2025-07-30 | Published 2025-08-08 | Updated 2025-08-08 | Assigner icscert

MEDIUM: 5.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

MEDIUM: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

Problem types

CWE-203

Product status

Default status

unaffected

all versions

affected

Default status

unaffected

all versions

affected

Default status

unaffected

all versions

affected

Default status

unaffected

all versions

affected

Default status

unaffected

all versions

affected

Default status

unaffected

all versions

affected

Default status

unaffected

all versions

affected

Credits

Anthony Rose of BC Security reported these vulnerabilities to CISA. finder

References

www.cisa.gov/news-events/ics-advisories/icsa-25-219-07

eg4electronics.com/contact/

cve.org (CVE-2025-47872)

nvd.nist.gov (CVE-2025-47872)

Download JSON