« Volver al listado

CVE-2025-4384

Estado: AplazadaMedia (6)—

The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet become valid. This allows malicious devices to present certificates that are not rejected properly.

The use of a client certificate reduces the risk for random devices to take advantage of this flaw.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Pcvue — Mqtt Add-onAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-4384",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-4384",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-06T19:28:43.088933Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "USER",
          "baseScore": 6,
          "Automatable": "NO",
          "attackVector": "ADJACENT",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:M/U:Green",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "GREEN",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "MODERATE",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
      "affectedData": [
        {
          "vendor": "arcinfo",
          "modules": [
            "MQTT add-on"
          ],
          "product": "PcVue",
          "versions": [
            {
              "status": "unaffected",
              "version": "16.3.0",
              "versionType": "cpe"
            },
            {
              "status": "affected",
              "version": "16.0",
              "lessThan": "16.2.5",
              "versionType": "cpe"
            },
            {
              "status": "affected",
              "version": "15.0",
              "lessThan": "15.2.12",
              "versionType": "cpe"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-05-06T16:15:32.340",
  "references": [
    {
      "url": "https://www.pcvue.com/security/#SB2025-3",
      "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932",
      "description": [
        {
          "lang": "en",
          "value": "CWE-298"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet become valid. This allows malicious devices to present certificates that are not rejected properly.\n\nThe use of a client certificate reduces the risk for random devices to take advantage of this flaw."
    },
    {
      "lang": "es",
      "value": "El complemento MQTT de PcVue no verifica que el certificado de un dispositivo remoto no haya caducado o no sea válido. Esto permite que dispositivos maliciosos presenten certificados que no se rechazan correctamente. El uso de un certificado de cliente reduce el riesgo de que dispositivos aleatorios se aprovechen de esta vulnerabilidad."
    }
  ],
  "lastModified": "2026-06-17T09:33:09.820",
  "sourceIdentifier": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932"
}