« Volver al listado

CVE-2025-25061

Estado: AplazadaMedia (5.8)—

Unintended proxy or intermediary ('Confused Deputy') issue exists in HMI ViewJet C-more series and HMI GC-A2 series, which may allow a remote unauthenticated attacker to use the product as an intermediary for FTP bounce attack.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Automationdirect — Gc-a2AIAutomationdirect — Viewjet C-moreAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-25061",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-25061",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-04T14:20:50.585279Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "vultures@jpcert.or.jp",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 5.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "JTEKT ELECTRONICS CORPORATION",
          "product": "HMI ViewJet C-more series",
          "versions": [
            {
              "status": "affected",
              "version": "All versions"
            }
          ]
        },
        {
          "vendor": "JTEKT ELECTRONICS CORPORATION",
          "product": "HMI GC-A2 series",
          "versions": [
            {
              "status": "affected",
              "version": "All versions"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-04-04T02:15:17.910",
  "references": [
    {
      "url": "https://jvn.jp/en/jp/JVN17260367/",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.electronics.jtekt.co.jp/en/topics/202503207269/",
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.electronics.jtekt.co.jp/en/topics/202503207271/",
      "source": "vultures@jpcert.or.jp"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "vultures@jpcert.or.jp",
      "description": [
        {
          "lang": "en",
          "value": "CWE-441"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unintended proxy or intermediary ('Confused Deputy') issue exists in HMI ViewJet C-more series and HMI GC-A2 series, which may allow a remote unauthenticated attacker to use the product as an intermediary for FTP bounce attack."
    },
    {
      "lang": "es",
      "value": "Existe un problema de proxy o intermediario no deseado ('Confused Deputy') en las series HMI ViewJet C-more y HMI GC-A2, que puede permitir que un atacante remoto no autenticado use el producto como intermediario para un ataque de rebote de FTP."
    }
  ],
  "lastModified": "2026-06-17T09:00:13.553",
  "sourceIdentifier": "vultures@jpcert.or.jp"
}