by Kastro
Paper/Archive/CVE-2025-25037

CVE-2025-25037

Aquatronica Aquatronica Controller System — Aquatronica Controller System Complete Information Disclosure

EPSS 2%public exploitCVSS 9.3
critical.is priorityof 100
53
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 75.4.754 × 2015.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

An information disclosure vulnerability exists in Aquatronica Controller System firmware versions <= 5.1.6 and web interface versions <= 2.0. The tcp.php endpoint fails to restrict unauthenticated access, allowing remote attackers to issue crafted POST requests and retrieve sensitive configuration data, including plaintext administrative credentials. Exploitation of this flaw can lead to full compromise of the system, enabling unauthorized manipulation of connected devices and aquarium parameters.

Affected

ProductAffectedFixed inSource
Aquatronica Controller System≤ 5.1.6–CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

exploitzeroscience.mk/en/vulnerabilities/ZSL-2024-5824.phpexploitexploit-db.com/exploits/52028writeupfortiguard.fortinet.com/encyclopedia/ips/56008refaquatronica.comwriteupvulncheck.com/advisories/aquatronica-controller-system-credential-leak