2 lines
3.2 KiB
JSON
2 lines
3.2 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","modules":["MQTT add-on"],"product":"PcVue","vendor":"arcinfo","versions":[{"status":"unaffected","version":"16.3.0","versionType":"cpe"},{"lessThan":"16.2.5","status":"affected","version":"16.0","versionType":"cpe"},{"lessThan":"15.2.12","status":"affected","version":"15.0","versionType":"cpe"}]}],"source":"87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet become valid. This allows malicious devices to present certificates that are not rejected properly.\n\nThe use of a client certificate reduces the risk for random devices to take advantage of this flaw."},{"lang":"es","value":"El complemento MQTT de PcVue no verifica que el certificado de un dispositivo remoto no haya caducado o no sea válido. Esto permite que dispositivos maliciosos presenten certificados que no se rechazan correctamente. El uso de un certificado de cliente reduce el riesgo de que dispositivos aleatorios se aprovechen de esta vulnerabilidad."}],"id":"CVE-2025-4384","lastModified":"2026-06-17T09:33:09.820","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NO","Recovery":"USER","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":6.0,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"GREEN","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:M/U:Green","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"MODERATE"},"source":"87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-4384","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-05-06T19:28:43.088933Z","version":"2.0.3"}}]},"published":"2025-05-06T16:15:32.340","references":[{"source":"87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932","url":"https://www.pcvue.com/security/#SB2025-3"}],"sourceIdentifier":"87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-298"}],"source":"87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932","type":"Secondary"}]}
|