CVE-2025-53520

HIGH

8.8

Descripcion

The affected product allows firmware updates to be downloaded from EG4's website, transferred via USB dongles, or installed through EG4's Monitoring Center (remote, cloud-connected interface) or via a serial connection, and can install these files without integrity checks. The TTComp archive format used for the firmware is unencrypted and can be unpacked and altered without detection.

Detalles CVE

Puntuacion CVSS v3.18.8

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioREQUIRED

Publicado8/8/2025

Ultima modificacion8/8/2025

Fuentenvd

Avistamientos honeypot0

Debilidades (CWE)

CWE-494

Referencias

https://eg4electronics.com/contact/(ics-cert@hq.dhs.gov)

https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-07(ics-cert@hq.dhs.gov)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.