CVE-2025-63224

critical · 10

The Itel DAB Encoder (IDEnc build 25aec8d) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers can reuse a valid JWT token obtained from one device to authenticate and gain administrative access to any other device running the same firmware, even if the passwords and networks are different. This allows full compromise of affected devices.

CVSS

0.7%

EPSS (exploit prob.)

52nd

EPSS percentile

2025-11-19

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-287CWE-384

Affected products

Vendor	Product	Affected versions
itel	idenc_firmware	all versions
itel	idenc	all versions

Check a specific version with /api/v1/cve/match.

References

https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63224_Itel%20DAB%20Encoder%20Authentication%20Bypass
https://www.itel.it/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-63224