CVE-2025-53520 | THREATINT

Description

The affected product allows firmware updates to be downloaded from EG4's website, transferred via USB dongles, or installed through EG4's Monitoring Center (remote, cloud-connected interface) or via a serial connection, and can install these files without integrity checks. The TTComp archive format used for the firmware is unencrypted and can be unpacked and altered without detection.

Reserved 2025-07-30 | Published 2025-08-08 | Updated 2025-08-08 | Assigner icscert

HIGH: 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

HIGH: 8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-494

Product status

Default status

unaffected

all versions

affected

Default status

unaffected

all versions

affected

Default status

unaffected

all versions

affected

Default status

unaffected

all versions

affected

Default status

unaffected

all versions

affected

Default status

unaffected

all versions

affected

Default status

unaffected

all versions

affected

Credits

Anthony Rose of BC Security reported these vulnerabilities to CISA. finder

References

www.cisa.gov/news-events/ics-advisories/icsa-25-219-07

eg4electronics.com/contact/

cve.org (CVE-2025-53520)

nvd.nist.gov (CVE-2025-53520)

Download JSON