by Kastro
Paper/Archive/CVE-2025-3495

CVE-2025-3495

Delta Electronics COMMGR — COMMGR - Insufficient Randomization Authentication Bypass

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 54.2.542 × 2010.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Delta Electronics COMMGR v1 and v2 uses insufficiently randomized values to generate session IDs (CWE-338). An attacker could easily brute force a session ID and load and execute arbitrary code.

Affected

ProductAffectedFixed inSource
COMMGRall versions–CNA

Scores by source

Deltaww (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reffilecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00005_COMMGR%20-%20Insufficient%20Randomization%20Authentication%20Bypass_v1.pdfrefcisa.gov/news-events/ics-advisories/icsa-25-105-07