CVE-2025-4286 (GCVE-0-2025-4286)
Vulnerability from cvelistv5
Published
2025-05-05 19:31
Modified
2025-05-05 20:05
Severity ?
5.1 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
2.7 (Low) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
2.7 (Low) - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
2.7 (Low) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
2.7 (Low) - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
VLAI Severity ?
EPSS score ?
Summary
A vulnerability was found in Intelbras InControl up to 2.21.59. It has been classified as problematic. Affected is an unknown function of the component Dispositivos Edição Page. The manipulation of the argument Senha de Comunicação leads to unprotected storage of credentials. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. According to the vendor this issue should be fixed in a later release.
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Intelbras | InControl |
Version: 2.21.0 Version: 2.21.1 Version: 2.21.2 Version: 2.21.3 Version: 2.21.4 Version: 2.21.5 Version: 2.21.6 Version: 2.21.7 Version: 2.21.8 Version: 2.21.9 Version: 2.21.10 Version: 2.21.11 Version: 2.21.12 Version: 2.21.13 Version: 2.21.14 Version: 2.21.15 Version: 2.21.16 Version: 2.21.17 Version: 2.21.18 Version: 2.21.19 Version: 2.21.20 Version: 2.21.21 Version: 2.21.22 Version: 2.21.23 Version: 2.21.24 Version: 2.21.25 Version: 2.21.26 Version: 2.21.27 Version: 2.21.28 Version: 2.21.29 Version: 2.21.30 Version: 2.21.31 Version: 2.21.32 Version: 2.21.33 Version: 2.21.34 Version: 2.21.35 Version: 2.21.36 Version: 2.21.37 Version: 2.21.38 Version: 2.21.39 Version: 2.21.40 Version: 2.21.41 Version: 2.21.42 Version: 2.21.43 Version: 2.21.44 Version: 2.21.45 Version: 2.21.46 Version: 2.21.47 Version: 2.21.48 Version: 2.21.49 Version: 2.21.50 Version: 2.21.51 Version: 2.21.52 Version: 2.21.53 Version: 2.21.54 Version: 2.21.55 Version: 2.21.56 Version: 2.21.57 Version: 2.21.58 Version: 2.21.59 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-4286",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-05T20:05:08.952078Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-05T20:05:12.475Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Dispositivos Edi\u00e7\u00e3o Page"
],
"product": "InControl",
"vendor": "Intelbras",
"versions": [
{
"status": "affected",
"version": "2.21.0"
},
{
"status": "affected",
"version": "2.21.1"
},
{
"status": "affected",
"version": "2.21.2"
},
{
"status": "affected",
"version": "2.21.3"
},
{
"status": "affected",
"version": "2.21.4"
},
{
"status": "affected",
"version": "2.21.5"
},
{
"status": "affected",
"version": "2.21.6"
},
{
"status": "affected",
"version": "2.21.7"
},
{
"status": "affected",
"version": "2.21.8"
},
{
"status": "affected",
"version": "2.21.9"
},
{
"status": "affected",
"version": "2.21.10"
},
{
"status": "affected",
"version": "2.21.11"
},
{
"status": "affected",
"version": "2.21.12"
},
{
"status": "affected",
"version": "2.21.13"
},
{
"status": "affected",
"version": "2.21.14"
},
{
"status": "affected",
"version": "2.21.15"
},
{
"status": "affected",
"version": "2.21.16"
},
{
"status": "affected",
"version": "2.21.17"
},
{
"status": "affected",
"version": "2.21.18"
},
{
"status": "affected",
"version": "2.21.19"
},
{
"status": "affected",
"version": "2.21.20"
},
{
"status": "affected",
"version": "2.21.21"
},
{
"status": "affected",
"version": "2.21.22"
},
{
"status": "affected",
"version": "2.21.23"
},
{
"status": "affected",
"version": "2.21.24"
},
{
"status": "affected",
"version": "2.21.25"
},
{
"status": "affected",
"version": "2.21.26"
},
{
"status": "affected",
"version": "2.21.27"
},
{
"status": "affected",
"version": "2.21.28"
},
{
"status": "affected",
"version": "2.21.29"
},
{
"status": "affected",
"version": "2.21.30"
},
{
"status": "affected",
"version": "2.21.31"
},
{
"status": "affected",
"version": "2.21.32"
},
{
"status": "affected",
"version": "2.21.33"
},
{
"status": "affected",
"version": "2.21.34"
},
{
"status": "affected",
"version": "2.21.35"
},
{
"status": "affected",
"version": "2.21.36"
},
{
"status": "affected",
"version": "2.21.37"
},
{
"status": "affected",
"version": "2.21.38"
},
{
"status": "affected",
"version": "2.21.39"
},
{
"status": "affected",
"version": "2.21.40"
},
{
"status": "affected",
"version": "2.21.41"
},
{
"status": "affected",
"version": "2.21.42"
},
{
"status": "affected",
"version": "2.21.43"
},
{
"status": "affected",
"version": "2.21.44"
},
{
"status": "affected",
"version": "2.21.45"
},
{
"status": "affected",
"version": "2.21.46"
},
{
"status": "affected",
"version": "2.21.47"
},
{
"status": "affected",
"version": "2.21.48"
},
{
"status": "affected",
"version": "2.21.49"
},
{
"status": "affected",
"version": "2.21.50"
},
{
"status": "affected",
"version": "2.21.51"
},
{
"status": "affected",
"version": "2.21.52"
},
{
"status": "affected",
"version": "2.21.53"
},
{
"status": "affected",
"version": "2.21.54"
},
{
"status": "affected",
"version": "2.21.55"
},
{
"status": "affected",
"version": "2.21.56"
},
{
"status": "affected",
"version": "2.21.57"
},
{
"status": "affected",
"version": "2.21.58"
},
{
"status": "affected",
"version": "2.21.59"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "eldruin (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Intelbras InControl up to 2.21.59. It has been classified as problematic. Affected is an unknown function of the component Dispositivos Edi\u00e7\u00e3o Page. The manipulation of the argument Senha de Comunica\u00e7\u00e3o leads to unprotected storage of credentials. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. According to the vendor this issue should be fixed in a later release."
},
{
"lang": "de",
"value": "Es wurde eine problematische Schwachstelle in Intelbras InControl bis 2.21.59 ausgemacht. Es geht dabei um eine nicht klar definierte Funktion der Komponente Dispositivos Edi\u00e7\u00e3o Page. Durch Manipulieren des Arguments Senha de Comunica\u00e7\u00e3o mit unbekannten Daten kann eine unprotected storage of credentials-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 3.3,
"vectorString": "AV:N/AC:L/Au:M/C:P/I:N/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-256",
"description": "Unprotected Storage of Credentials",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-255",
"description": "Credentials Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-05T19:31:04.865Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-307392 | Intelbras InControl Dispositivos Edi\u00e7\u00e3o Page credentials storage",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.307392"
},
{
"name": "VDB-307392 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.307392"
},
{
"name": "Submit #483834 | Intelbras InControl 2.21.57 Insecure Storage of Sensitive Information",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.483834"
},
{
"tags": [
"exploit"
],
"url": "https://eldruin.notion.site/Intelbras-InControl-v2-21-57-Storing-password-in-insecure-format-17d27474cccb8003b647ea832186b162?pvs=4"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-05-05T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-05-05T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-05-05T13:51:11.000Z",
"value": "VulDB entry last update"
}
],
"title": "Intelbras InControl Dispositivos Edi\u00e7\u00e3o Page credentials storage"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-4286",
"datePublished": "2025-05-05T19:31:04.865Z",
"dateReserved": "2025-05-05T11:46:08.317Z",
"dateUpdated": "2025-05-05T20:05:12.475Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"shortName\": \"VulDB\", \"dateUpdated\": \"2025-05-05T19:31:04.865Z\"}, \"title\": \"Intelbras InControl Dispositivos Edi\\u00e7\\u00e3o Page credentials storage\", \"problemTypes\": [{\"descriptions\": [{\"type\": \"CWE\", \"cweId\": \"CWE-256\", \"lang\": \"en\", \"description\": \"Unprotected Storage of Credentials\"}]}, {\"descriptions\": [{\"type\": \"CWE\", \"cweId\": \"CWE-255\", \"lang\": \"en\", \"description\": \"Credentials Management\"}]}], \"affected\": [{\"vendor\": \"Intelbras\", \"product\": \"InControl\", \"versions\": [{\"version\": \"2.21.0\", \"status\": \"affected\"}, {\"version\": \"2.21.1\", \"status\": \"affected\"}, {\"version\": \"2.21.2\", \"status\": \"affected\"}, {\"version\": \"2.21.3\", \"status\": \"affected\"}, {\"version\": \"2.21.4\", \"status\": \"affected\"}, {\"version\": \"2.21.5\", \"status\": \"affected\"}, {\"version\": \"2.21.6\", \"status\": \"affected\"}, {\"version\": \"2.21.7\", \"status\": \"affected\"}, {\"version\": \"2.21.8\", \"status\": \"affected\"}, {\"version\": \"2.21.9\", \"status\": \"affected\"}, {\"version\": \"2.21.10\", \"status\": \"affected\"}, {\"version\": \"2.21.11\", \"status\": \"affected\"}, {\"version\": \"2.21.12\", \"status\": \"affected\"}, {\"version\": \"2.21.13\", \"status\": \"affected\"}, {\"version\": \"2.21.14\", \"status\": \"affected\"}, {\"version\": \"2.21.15\", \"status\": \"affected\"}, {\"version\": \"2.21.16\", \"status\": \"affected\"}, {\"version\": \"2.21.17\", \"status\": \"affected\"}, {\"version\": \"2.21.18\", \"status\": \"affected\"}, {\"version\": \"2.21.19\", \"status\": \"affected\"}, {\"version\": \"2.21.20\", \"status\": \"affected\"}, {\"version\": \"2.21.21\", \"status\": \"affected\"}, {\"version\": \"2.21.22\", \"status\": \"affected\"}, {\"version\": \"2.21.23\", \"status\": \"affected\"}, {\"version\": \"2.21.24\", \"status\": \"affected\"}, {\"version\": \"2.21.25\", \"status\": \"affected\"}, {\"version\": \"2.21.26\", \"status\": \"affected\"}, {\"version\": \"2.21.27\", \"status\": \"affected\"}, {\"version\": \"2.21.28\", \"status\": \"affected\"}, {\"version\": \"2.21.29\", \"status\": \"affected\"}, {\"version\": \"2.21.30\", \"status\": \"affected\"}, {\"version\": \"2.21.31\", \"status\": \"affected\"}, {\"version\": \"2.21.32\", \"status\": \"affected\"}, {\"version\": \"2.21.33\", \"status\": \"affected\"}, {\"version\": \"2.21.34\", \"status\": \"affected\"}, {\"version\": \"2.21.35\", \"status\": \"affected\"}, {\"version\": \"2.21.36\", \"status\": \"affected\"}, {\"version\": \"2.21.37\", \"status\": \"affected\"}, {\"version\": \"2.21.38\", \"status\": \"affected\"}, {\"version\": \"2.21.39\", \"status\": \"affected\"}, {\"version\": \"2.21.40\", \"status\": \"affected\"}, {\"version\": \"2.21.41\", \"status\": \"affected\"}, {\"version\": \"2.21.42\", \"status\": \"affected\"}, {\"version\": \"2.21.43\", \"status\": \"affected\"}, {\"version\": \"2.21.44\", \"status\": \"affected\"}, {\"version\": \"2.21.45\", \"status\": \"affected\"}, {\"version\": \"2.21.46\", \"status\": \"affected\"}, {\"version\": \"2.21.47\", \"status\": \"affected\"}, {\"version\": \"2.21.48\", \"status\": \"affected\"}, {\"version\": \"2.21.49\", \"status\": \"affected\"}, {\"version\": \"2.21.50\", \"status\": \"affected\"}, {\"version\": \"2.21.51\", \"status\": \"affected\"}, {\"version\": \"2.21.52\", \"status\": \"affected\"}, {\"version\": \"2.21.53\", \"status\": \"affected\"}, {\"version\": \"2.21.54\", \"status\": \"affected\"}, {\"version\": \"2.21.55\", \"status\": \"affected\"}, {\"version\": \"2.21.56\", \"status\": \"affected\"}, {\"version\": \"2.21.57\", \"status\": \"affected\"}, {\"version\": \"2.21.58\", \"status\": \"affected\"}, {\"version\": \"2.21.59\", \"status\": \"affected\"}], \"modules\": [\"Dispositivos Edi\\u00e7\\u00e3o Page\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability was found in Intelbras InControl up to 2.21.59. It has been classified as problematic. Affected is an unknown function of the component Dispositivos Edi\\u00e7\\u00e3o Page. The manipulation of the argument Senha de Comunica\\u00e7\\u00e3o leads to unprotected storage of credentials. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. According to the vendor this issue should be fixed in a later release.\"}, {\"lang\": \"de\", \"value\": \"Es wurde eine problematische Schwachstelle in Intelbras InControl bis 2.21.59 ausgemacht. Es geht dabei um eine nicht klar definierte Funktion der Komponente Dispositivos Edi\\u00e7\\u00e3o Page. Durch Manipulieren des Arguments Senha de Comunica\\u00e7\\u00e3o mit unbekannten Daten kann eine unprotected storage of credentials-Schwachstelle ausgenutzt werden. Der Angriff kann \\u00fcber das Netzwerk passieren. Der Exploit steht zur \\u00f6ffentlichen Verf\\u00fcgung.\"}], \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 5.1, \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N\", \"baseSeverity\": \"MEDIUM\"}}, {\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 2.7, \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N\", \"baseSeverity\": \"LOW\"}}, {\"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 2.7, \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N\", \"baseSeverity\": \"LOW\"}}, {\"cvssV2_0\": {\"version\": \"2.0\", \"baseScore\": 3.3, \"vectorString\": \"AV:N/AC:L/Au:M/C:P/I:N/A:N\"}}], \"timeline\": [{\"time\": \"2025-05-05T00:00:00.000Z\", \"lang\": \"en\", \"value\": \"Advisory disclosed\"}, {\"time\": \"2025-05-05T02:00:00.000Z\", \"lang\": \"en\", \"value\": \"VulDB entry created\"}, {\"time\": \"2025-05-05T13:51:11.000Z\", \"lang\": \"en\", \"value\": \"VulDB entry last update\"}], \"credits\": [{\"lang\": \"en\", \"value\": \"eldruin (VulDB User)\", \"type\": \"reporter\"}], \"references\": [{\"url\": \"https://vuldb.com/?id.307392\", \"name\": \"VDB-307392 | Intelbras InControl Dispositivos Edi\\u00e7\\u00e3o Page credentials storage\", \"tags\": [\"vdb-entry\", \"technical-description\"]}, {\"url\": \"https://vuldb.com/?ctiid.307392\", \"name\": \"VDB-307392 | CTI Indicators (IOB, IOC, TTP, IOA)\", \"tags\": [\"signature\", \"permissions-required\"]}, {\"url\": \"https://vuldb.com/?submit.483834\", \"name\": \"Submit #483834 | Intelbras InControl 2.21.57 Insecure Storage of Sensitive Information\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://eldruin.notion.site/Intelbras-InControl-v2-21-57-Storing-password-in-insecure-format-17d27474cccb8003b647ea832186b162?pvs=4\", \"tags\": [\"exploit\"]}]}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-4286\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-05-05T20:05:08.952078Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-05-05T20:04:55.429Z\"}}]}",
"cveMetadata": "{\"cveId\": \"CVE-2025-4286\", \"assignerOrgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"VulDB\", \"dateReserved\": \"2025-05-05T11:46:08.317Z\", \"datePublished\": \"2025-05-05T19:31:04.865Z\", \"dateUpdated\": \"2025-05-05T20:05:12.475Z\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…