{"id":"CVE-2025-47872","url":"https://www.cyber-defence.io/tools/cve/CVE-2025-47872","generatedAt":"2026-10-28T13:14:17.525Z","title":"Combined with the fact that serial numbers are sequentially assigned, this allows an attacker to gain information on the product registration status of different S/Ns.","description":"The public-facing product registration endpoint server responds \ndifferently depending on whether the S/N is valid and unregistered, \nvalid but already registered, or does not exist in the database. \nCombined with the fact that serial numbers are sequentially assigned, \nthis allows an attacker to gain information on the product registration \nstatus of different S/Ns.","published":"2025-08-08T17:15:29.000Z","lastModified":"2026-06-17T09:28:47.000Z","status":"Deferred","sourceIdentifier":"ics-cert@hq.dhs.gov","cvss":{"version":"4.0","score":6.9,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-203"],"affected":[],"epss":{"score":0.00312,"percentile":0.23916,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.31%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://eg4electronics.com/contact/","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-07","source":"ics-cert@hq.dhs.gov"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-47872","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}