VulnerabilityDeferred

CVE-2025-61234

Incorrect access control on Dataphone A920 v2025.07.161103 exposes a service on port 8888 by default on the local network without authentication.

HIGH 7.5EPSS 0.32%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.32%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Incorrect access control on Dataphone A920 v2025.07.161103 exposes a service on port 8888 by default on the local network without authentication. This allows an attacker to interact with the device via a TCP socket without credentials. Additionally, sending an HTTP request to the service on port 8888 triggers an error in the response, which exposes the functionality, headers identifying Paytef dataphone packets, and the build version.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.32% probability · 25th percentile
CISA KEV: Not listed
Weakness: CWE-284
Source: cve@mitre.org

References

https://github.com/stuxve/expose-service-8888-dataphone

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.