CVE-2025-0681

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-0681", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2025-01-23T16:50:56.326Z", "datePublished": "2025-01-30T18:53:09.669Z", "dateUpdated": "2025-01-30T19:11:58.156Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "OM500 IP-PBX", "vendor": "New Rock Technologies", "versions": [{"status": "affected", "version": "All"}]}, {"defaultStatus": "unaffected", "product": "MX8G VoIP Gateway", "vendor": "New Rock Technologies", "versions": [{"status": "affected", "version": "All"}]}, {"defaultStatus": "unaffected", "product": "NRP1302/P Desktop IP Phone", "vendor": "New Rock Technologies", "versions": [{"status": "affected", "version": "All"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Tomer Goldschmidt of Claroty Team82 reported these vulnerabilities to CISA."}], "datePublic": "2025-01-30T17:26:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The Cloud MQTT service of the affected products supports wildcard topic \nsubscription which could allow an attacker to obtain sensitive \ninformation from tapping the service communications."}], "value": "The Cloud MQTT service of the affected products supports wildcard topic \nsubscription which could allow an attacker to obtain sensitive \ninformation from tapping the service communications."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-155", "description": "CWE-155", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2025-01-30T18:53:09.669Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-030-02"}, {"url": "https://www.newrocktech.com/ContactUs/index.html"}], "source": {"advisory": "ICSA-25-030-02", "discovery": "EXTERNAL"}, "title": "New Rock Technologies Cloud Connected Devices Improper Neutralization of Wildcards or Matching Symbols", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "New Rock Technologies has not responded to requests to work with CISA to\n mitigate these vulnerabilities. Users of affected versions of New Rock \nTechnologies Cloud Connected Devices are invited to contact New Rock \nTechnologies <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.newrocktech.com/ContactUs/index.html\">customer support</a> for additional information.\n\n<br>"}], "value": "New Rock Technologies has not responded to requests to work with CISA to\n mitigate these vulnerabilities. Users of affected versions of New Rock \nTechnologies Cloud Connected Devices are invited to contact New Rock \nTechnologies customer support https://www.newrocktech.com/ContactUs/index.html for additional information."}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-30T19:11:47.355418Z", "id": "CVE-2025-0681", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-30T19:11:58.156Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-0681", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-01-30T19:11:47.355418Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-30T19:11:53.125Z"}}], "cna": {"title": "New Rock Technologies Cloud Connected Devices Improper Neutralization of Wildcards or Matching Symbols", "source": {"advisory": "ICSA-25-030-02", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Tomer Goldschmidt of Claroty Team82 reported these vulnerabilities to CISA."}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "New Rock Technologies", "product": "OM500 IP-PBX", "versions": [{"status": "affected", "version": "All"}], "defaultStatus": "unaffected"}, {"vendor": "New Rock Technologies", "product": "MX8G VoIP Gateway", "versions": [{"status": "affected", "version": "All"}], "defaultStatus": "unaffected"}, {"vendor": "New Rock Technologies", "product": "NRP1302/P Desktop IP Phone", "versions": [{"status": "affected", "version": "All"}], "defaultStatus": "unaffected"}], "datePublic": "2025-01-30T17:26:00.000Z", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-030-02"}, {"url": "https://www.newrocktech.com/ContactUs/index.html"}], "workarounds": [{"lang": "en", "value": "New Rock Technologies has not responded to requests to work with CISA to\n mitigate these vulnerabilities. Users of affected versions of New Rock \nTechnologies Cloud Connected Devices are invited to contact New Rock \nTechnologies customer support https://www.newrocktech.com/ContactUs/index.html for additional information.", "supportingMedia": [{"type": "text/html", "value": "New Rock Technologies has not responded to requests to work with CISA to\n mitigate these vulnerabilities. Users of affected versions of New Rock \nTechnologies Cloud Connected Devices are invited to contact New Rock \nTechnologies <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.newrocktech.com/ContactUs/index.html\">customer support</a> for additional information.\n\n<br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The Cloud MQTT service of the affected products supports wildcard topic \nsubscription which could allow an attacker to obtain sensitive \ninformation from tapping the service communications.", "supportingMedia": [{"type": "text/html", "value": "The Cloud MQTT service of the affected products supports wildcard topic \nsubscription which could allow an attacker to obtain sensitive \ninformation from tapping the service communications.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-155", "description": "CWE-155"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2025-01-30T18:53:09.669Z"}}}, "cveMetadata": {"cveId": "CVE-2025-0681", "state": "PUBLISHED", "dateUpdated": "2025-01-30T19:11:58.156Z", "dateReserved": "2025-01-23T16:50:56.326Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2025-01-30T18:53:09.669Z", "assignerShortName": "icscert"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "OM500 IP-PBX", "vendor": "New Rock Technologies", "versions": [{"status": "affected", "version": "All"}]}, {"defaultStatus": "unaffected", "product": "MX8G VoIP Gateway", "vendor": "New Rock Technologies", "versions": [{"status": "affected", "version": "All"}]}, {"defaultStatus": "unaffected", "product": "NRP1302/P Desktop IP Phone", "vendor": "New Rock Technologies", "versions": [{"status": "affected", "version": "All"}]}], "source": "ics-cert@hq.dhs.gov"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Cloud MQTT service of the affected products supports wildcard topic \nsubscription which could allow an attacker to obtain sensitive \ninformation from tapping the service communications."}, {"lang": "es", "value": "El servicio Cloud MQTT de los productos afectados admite la suscripci\u00f3n a temas comod\u00edn, lo que podr\u00eda permitir que un atacante obtenga informaci\u00f3n confidencial al interceptar las comunicaciones del servicio."}], "id": "CVE-2025-0681", "lastModified": "2026-06-17T08:26:57.547", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 3.6, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-0681", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-01-30T19:11:47.355418Z", "version": "2.0.3"}}]}, "published": "2025-01-30T19:15:14.300", "references": [{"source": "ics-cert@hq.dhs.gov", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-030-02"}, {"source": "ics-cert@hq.dhs.gov", "url": "https://www.newrocktech.com/ContactUs/index.html"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-155"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}

{}