« Volver al listado

CVE-2025-64389

Estado: AplazadaAlta (8.3)—

The web server of the device performs exchanges of sensitive information in clear text through an insecure protocol.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

CVSS AV:N UI:A sugiere interacción del usuario (T1203). CWE-319 indica transmisión en claro; el atacante en la red puede interceptar información sensible (T1040, T1557.002).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Encrypt Sensitive InformationUser TrainingUser Account ManagementNetwork SegmentationNetwork Intrusion PreventionMulti-factor Authentication

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-64389",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-64389",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-11-03T19:11:35.879313Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "50b5080a-775f-442e-83b5-926b5ca517b6",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.3,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "ACTIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "50b5080a-775f-442e-83b5-926b5ca517b6",
      "affectedData": [
        {
          "vendor": "Circutor",
          "product": "TCPRS1plus",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.14",
              "versionType": "Firmware"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2025-10-31T15:15:44.057",
  "references": [
    {
      "url": "https://cds.thalesgroup.com/es/s21sec",
      "source": "50b5080a-775f-442e-83b5-926b5ca517b6"
    },
    {
      "url": "https://circutor.com/productos/iot-industrial-y-automatizacion/conversores-y-pasarelas/product/D80010./",
      "source": "50b5080a-775f-442e-83b5-926b5ca517b6"
    },
    {
      "url": "https://www.hackrtu.com/blog/cg-0day-en-003/",
      "source": "50b5080a-775f-442e-83b5-926b5ca517b6"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "50b5080a-775f-442e-83b5-926b5ca517b6",
      "description": [
        {
          "lang": "en",
          "value": "CWE-319"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The web server of the device performs exchanges of sensitive information in clear text through an insecure protocol."
    },
    {
      "lang": "es",
      "value": "El servidor web del dispositivo realiza intercambios de información sensible en texto claro a través de un protocolo inseguro."
    }
  ],
  "lastModified": "2026-06-17T09:54:19.320",
  "sourceIdentifier": "50b5080a-775f-442e-83b5-926b5ca517b6"
}