VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity
Files
249bc4cebedade5155d8eeefbac7a00eae5d85bc
vuln-cve/data/2025/3xxx/CVE-2025-3232.json
T

193 lines
9.1 KiB
JSON
Raw Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2025-3232",
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"state": "PUBLISHED",
"assignerShortName": "icscert",
"dateReserved": "2025-04-03T16:06:31.944Z",
"datePublished": "2025-12-24T19:55:43.172Z",
"dateUpdated": "2025-12-24T20:01:27.393Z"
},
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "smartRTU",
"vendor": "Mitsubishi Electric Europe",
"versions": [
{
"lessThanOrEqual": "3.37",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Noam Moshe of Claroty Team82 reported this vulnerability to CISA."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A remote unauthenticated attacker may be able to bypass authentication \nby utilizing a specific API route to execute arbitrary OS commands."
}
],
"value": "A remote unauthenticated attacker may be able to bypass authentication \nby utilizing a specific API route to execute arbitrary OS commands."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert",
"dateUpdated": "2025-12-24T19:55:43.172Z"
},
"references": [
{
"url": "https://emea.mitsubishielectric.com/fa/products/quality/quality-news-information"
},
{
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-09"
},
{
"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-105-09.json"
}
],
"source": {
"advisory": "ICSA-25-105-09",
"discovery": "EXTERNAL"
},
"title": "Mitsubishi Electric Europe smartRTU Missing Authentication for Critical Function",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "<p>Mitsubishi Electric Europe B.V. recommends that users take note of \nthe following mitigation measures to minimize the risk of exploiting \nthis vulnerability:</p>\n<ul>\n<li>Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required.</li>\n<li>Use within a LAN and block access from untrusted networks and hosts through firewalls.</li>\n<li>Use web application firewall (WAF) to prevent to filter, monitor and block any malicious HTTP/HTTPS traffic.</li>\n<li>Allow web client access from trusted networks only.</li>\n</ul><p>For more information, please see <a target=\"_blank\" rel=\"nofollow\" href=\"https://emea.mitsubishielectric.com/fa/products/quality/quality-news-information\">Mitsubishi Electric Europe MEU_PSIRT_2025-3128</a>&nbsp;under the \"Vulnerability Information\" section.\n\n<br></p>"
}
],
"value": "Mitsubishi Electric Europe B.V. recommends that users take note of \nthe following mitigation measures to minimize the risk of exploiting \nthis vulnerability:\n\n\n\n * Use a firewall or virtual private network (VPN), etc. to prevent unauthorized access when Internet access is required.\n\n * Use within a LAN and block access from untrusted networks and hosts through firewalls.\n\n * Use web application firewall (WAF) to prevent to filter, monitor and block any malicious HTTP/HTTPS traffic.\n\n * Allow web client access from trusted networks only.\n\n\n\nFor more information, please see Mitsubishi Electric Europe MEU_PSIRT_2025-3128 https://emea.mitsubishielectric.com/fa/products/quality/quality-news-information  under the \"Vulnerability Information\" section."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2025-12-24T20:01:03.204248Z",
"id": "CVE-2025-3232",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2025-12-24T20:01:27.393Z"
}
}
]
}
}
View Git Blame Copy Permalink