CVE-2025-61235

critical · 9.1

An issue was discovered in Dataphone A920 v2025.07.161103. A custom packet based on public documentation can be crafted, where some fields can contain arbitrary or trivial data. Normally, such data should cause the device to reject the packet. However, due to a lack of validation, the device accepts it with no authetication and triggers the functionality instead.

9.1

CVSS

0.4%

EPSS (exploit prob.)

30th

EPSS percentile

2025-10-28

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weaknesses

CWE-20

References

https://github.com/stuxve/poc-dataphone-crafted-packet

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-61235