by Kastro
Paper/Archive/CVE-2025-64385

CVE-2025-64385

Circutor TCPRS1plus — INCORRECT SECURITY VALIDATION IN SENDING UDP FRAMES

EPSS 0.4%CVSS 9.2
critical.is priorityof 100
35
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 34.8.348 × 207.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The equipment initially can be configured using the manufacturer's application, by Wi-Fi, by the web server or with the manufacturer’s software. Using the manufacturer's software, the device can be configured via UDP. Analyzing this communication, it has been observed that any aspect of the initial configuration can be changed by means of the device's MAC without the need for authentication.

Affected

ProductAffectedFixed inSource
TCPRS1plus1.0.14–CNA

Scores by source

S21sec (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refcds.thalesgroup.com/es/s21secrefcircutor.com/productos/iot-industrial-y-automatizacion/conversores-y-pasarelas/product/D80010.writeuphackrtu.com/blog/cg-0day-en-003