« Volver al listado

CVE-2025-47417

Estado: AplazadaMedia (5.1)—

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Crestron Automate VX allows Functionality Misuse.

When Enable Debug Images in Crestron Automate VX is active, snapshots of the captured video or portions thereof are stored locally on the system, and there is no visible indication that this is being done.

This issue affects Automate VX: from 5.6.8161.21536 through 6.4.0.49.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Crestron — Automate VXAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-47417",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-47417",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-08T18:34:55.584949Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "25b0b659-c4b4-483f-aecb-067757d23ef3",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 5.1,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "HIGH",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "25b0b659-c4b4-483f-aecb-067757d23ef3",
      "affectedData": [
        {
          "vendor": "Crestron",
          "product": "Automate VX",
          "versions": [
            {
              "status": "affected",
              "changes": [
                {
                  "at": "6.4.1.8",
                  "status": "unaffected"
                }
              ],
              "version": "5.6.8161.21536",
              "versionType": "custom",
              "lessThanOrEqual": "6.4.0.49"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-05-06T20:15:27.333",
  "references": [
    {
      "url": "https://security.crestron.com",
      "source": "25b0b659-c4b4-483f-aecb-067757d23ef3"
    },
    {
      "url": "https://www.crestron.com/Software-Firmware/Software/Automate-VX-Software/6-4-1-8",
      "source": "25b0b659-c4b4-483f-aecb-067757d23ef3"
    },
    {
      "url": "https://www.crestron.com/release_notes/automate_vx_6.4.1.8_release_notes.pdf",
      "source": "25b0b659-c4b4-483f-aecb-067757d23ef3"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "25b0b659-c4b4-483f-aecb-067757d23ef3",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Crestron Automate VX allows Functionality Misuse.\n\n\n\nWhen Enable Debug Images in Crestron Automate VX is active, snapshots of the captured video or portions thereof are stored locally on the system, and there is no visible indication that this is being done.\n\n\nThis issue affects Automate VX: from 5.6.8161.21536 through 6.4.0.49."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de exposición de información sensible a un actor no autorizado en Crestron Automate VX permite el uso indebido de la funcionalidad. Cuando la opción \"Habilitar imágenes de depuración\" en Crestron Automate VX está activa, las instantáneas del vídeo capturado o fragmentos del mismo se almacenan localmente en el sistema, sin que haya indicios visibles de que esto ocurra. Este problema afecta a Automate VX desde la versión 5.6.8161.21536 hasta la 6.4.0.49."
    }
  ],
  "lastModified": "2026-06-17T09:28:05.307",
  "sourceIdentifier": "25b0b659-c4b4-483f-aecb-067757d23ef3"
}