VulnerabilityDeferred

CVE-2025-51381

An authentication bypass vulnerability exists in KCM3100 Ver1.4.2 and earlier.

CRITICAL 9.3EPSS 0.67%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.67%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An authentication bypass vulnerability exists in KCM3100 Ver1.4.2 and earlier. If this vulnerability is exploited, an attacker may bypass the authentication of the product from within the LAN to which the product is connected.

CVSS 4.0: 9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.67% probability · 50th percentile
CISA KEV: Not listed
Weakness: CWE-288
Source: vultures@jpcert.or.jp

References

https://jvn.jp/en/jp/JVN46288336/
https://notices.jcom.co.jp/notice/93847.html

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.