CVE-2025-34034

critical · 9.3

A hardcoded credential vulnerability exists in the Blue Angel Software Suite deployed on embedded Linux systems. The application contains multiple known default and hardcoded user accounts that are not disclosed in public documentation. These accounts allow unauthenticated or low-privilege attackers to gain administrative access to the device’s web interface. Exploitation evidence was observed by the Shadowserver Foundation on 2025-01-26 UTC.

9.3

CVSS

0.6%

EPSS (exploit prob.)

48th

EPSS percentile

2025-06-24

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-798

Affected products

Vendor	Product	Affected versions
5vtechnologies	blue_angel_software_suite	all versions

Check a specific version with /api/v1/cve/match.

References

https://vulncheck.com/advisories/5vtechnologies-blue-angel-hardcoded-credentials
https://www.exploit-db.com/exploits/46792
https://www.exploit-db.com/exploits/46792

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-34034