VULNERABILITY INTELLIGENCE
CVE-2025-61234
CVSS score7.5 HIGH
EPSS probability0.34%
CISA KEVNot currently listed
Published2025-10-29
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
Incorrect access control on Dataphone A920 v2025.07.161103 exposes a service on port 8888 by default on the local network without authentication. This allows an attacker to interact with the device via a TCP socket without credentials. Additionally, sending an HTTP request to the service on port 8888 triggers an error in the response, which exposes the functionality, headers identifying Paytef dataphone packets, and the build version.
Weakness classification
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-284