VulnerabilityDeferred
CVE-2025-64305
An attacker can utilize these plaintext secrets to modify the vendor firmware, or gain admin access to the web portal.
HIGH 7.1EPSS 0.14%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.14%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
MicroServer copies parts of the system firmware to an unencrypted external SD card on boot, which contains user and vendor secrets. An attacker can utilize these plaintext secrets to modify the vendor firmware, or gain admin access to the web portal.
- CVSS 4.0
- 7.1 HIGHCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.14% probability · 3th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-313
- Source
- ics-cert@hq.dhs.gov
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.