CVE-2025-3403

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-3403", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2025-04-07T10:22:01.598Z", "datePublished": "2025-04-08T03:00:11.278Z", "dateUpdated": "2025-04-08T18:24:22.074Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-04-08T03:00:11.278Z"}, "title": "Vivotek NVR ND8422P/NVR ND9525P/NVR ND9541P HTML Form sensitive information in source", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-540", "lang": "en", "description": "Inclusion of Sensitive Information in Source Code"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-200", "lang": "en", "description": "Information Disclosure"}]}], "affected": [{"vendor": "Vivotek", "product": "NVR ND8422P", "versions": [{"version": "2.4.0.204", "status": "affected"}, {"version": "3.3.0.104", "status": "affected"}, {"version": "4.2.0.101", "status": "affected"}], "modules": ["HTML Form Handler"]}, {"vendor": "Vivotek", "product": "NVR ND9525P", "versions": [{"version": "2.4.0.204", "status": "affected"}, {"version": "3.3.0.104", "status": "affected"}, {"version": "4.2.0.101", "status": "affected"}], "modules": ["HTML Form Handler"]}, {"vendor": "Vivotek", "product": "NVR ND9541P", "versions": [{"version": "2.4.0.204", "status": "affected"}, {"version": "3.3.0.104", "status": "affected"}, {"version": "4.2.0.101", "status": "affected"}], "modules": ["HTML Form Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Vivotek NVR ND8422P, NVR ND9525P and NVR ND9541P 2.4.0.204/3.3.0.104/4.2.0.101. It has been classified as problematic. Affected is an unknown function of the component HTML Form Handler. The manipulation leads to inclusion of sensitive information in source code. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "de", "value": "Es wurde eine problematische Schwachstelle in Vivotek NVR ND8422P, NVR ND9525P and NVR ND9541P 2.4.0.204/3.3.0.104/4.2.0.101 ausgemacht. Dabei betrifft es einen unbekannter Codeteil der Komponente HTML Form Handler. Durch Manipulation mit unbekannten Daten kann eine inclusion of sensitive information in source code-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 2.7, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 2.7, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 3.3, "vectorString": "AV:N/AC:L/Au:M/C:P/I:N/A:N"}}], "timeline": [{"time": "2025-04-07T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2025-04-07T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2025-04-07T12:27:05.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Syrtain (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.303648", "name": "VDB-303648 | Vivotek NVR ND8422P/NVR ND9525P/NVR ND9541P HTML Form sensitive information in source", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.303648", "name": "VDB-303648 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.543589", "name": "Submit #543589 | VIVOTEK NVR Core + 4.2.0.101 and below Cleartext Storage of Sensitive Information in GUI", "tags": ["third-party-advisory"]}, {"url": "https://github.com/lfparizzi/CVE-VIVOTEK-ID/blob/main/README.md", "tags": ["exploit"]}]}, "adp": [{"references": [{"url": "https://github.com/lfparizzi/CVE-VIVOTEK-ID/blob/main/README.md", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-08T15:46:08.310718Z", "id": "CVE-2025-3403", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-08T18:24:22.074Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3403", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-08T15:46:08.310718Z"}}}], "references": [{"url": "https://github.com/lfparizzi/CVE-VIVOTEK-ID/blob/main/README.md", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-08T15:46:17.831Z"}}], "cna": {"title": "Vivotek NVR ND8422P/NVR ND9525P/NVR ND9541P HTML Form sensitive information in source", "credits": [{"lang": "en", "type": "reporter", "value": "Syrtain (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 2.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 2.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 3.3, "vectorString": "AV:N/AC:L/Au:M/C:P/I:N/A:N"}}], "affected": [{"vendor": "Vivotek", "modules": ["HTML Form Handler"], "product": "NVR ND8422P", "versions": [{"status": "affected", "version": "2.4.0.204"}, {"status": "affected", "version": "3.3.0.104"}, {"status": "affected", "version": "4.2.0.101"}]}, {"vendor": "Vivotek", "modules": ["HTML Form Handler"], "product": "NVR ND9525P", "versions": [{"status": "affected", "version": "2.4.0.204"}, {"status": "affected", "version": "3.3.0.104"}, {"status": "affected", "version": "4.2.0.101"}]}, {"vendor": "Vivotek", "modules": ["HTML Form Handler"], "product": "NVR ND9541P", "versions": [{"status": "affected", "version": "2.4.0.204"}, {"status": "affected", "version": "3.3.0.104"}, {"status": "affected", "version": "4.2.0.101"}]}], "timeline": [{"lang": "en", "time": "2025-04-07T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2025-04-07T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2025-04-07T12:27:05.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.303648", "name": "VDB-303648 | Vivotek NVR ND8422P/NVR ND9525P/NVR ND9541P HTML Form sensitive information in source", "tags": ["vdb-entry"]}, {"url": "https://vuldb.com/?ctiid.303648", "name": "VDB-303648 | CTI Indicators (IOB, IOC, TTP)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.543589", "name": "Submit #543589 | VIVOTEK NVR Core + 4.2.0.101 and below Cleartext Storage of Sensitive Information in GUI", "tags": ["third-party-advisory"]}, {"url": "https://github.com/lfparizzi/CVE-VIVOTEK-ID/blob/main/README.md", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Vivotek NVR ND8422P, NVR ND9525P and NVR ND9541P 2.4.0.204/3.3.0.104/4.2.0.101. It has been classified as problematic. Affected is an unknown function of the component HTML Form Handler. The manipulation leads to inclusion of sensitive information in source code. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "de", "value": "Es wurde eine problematische Schwachstelle in Vivotek NVR ND8422P, NVR ND9525P and NVR ND9541P 2.4.0.204/3.3.0.104/4.2.0.101 ausgemacht. Dabei betrifft es einen unbekannter Codeteil der Komponente HTML Form Handler. Durch Manipulation mit unbekannten Daten kann eine inclusion of sensitive information in source code-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-540", "description": "Inclusion of Sensitive Information in Source Code"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "Information Disclosure"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-04-08T03:00:11.278Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3403", "state": "PUBLISHED", "dateUpdated": "2025-04-08T18:24:22.074Z", "dateReserved": "2025-04-07T10:22:01.598Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2025-04-08T03:00:11.278Z", "assignerShortName": "VulDB"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"modules": ["HTML Form Handler"], "product": "NVR ND8422P", "vendor": "Vivotek", "versions": [{"status": "affected", "version": "2.4.0.204"}, {"status": "affected", "version": "3.3.0.104"}, {"status": "affected", "version": "4.2.0.101"}]}, {"modules": ["HTML Form Handler"], "product": "NVR ND9525P", "vendor": "Vivotek", "versions": [{"status": "affected", "version": "2.4.0.204"}, {"status": "affected", "version": "3.3.0.104"}, {"status": "affected", "version": "4.2.0.101"}]}, {"modules": ["HTML Form Handler"], "product": "NVR ND9541P", "vendor": "Vivotek", "versions": [{"status": "affected", "version": "2.4.0.204"}, {"status": "affected", "version": "3.3.0.104"}, {"status": "affected", "version": "4.2.0.101"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Vivotek NVR ND8422P, NVR ND9525P and NVR ND9541P 2.4.0.204/3.3.0.104/4.2.0.101. It has been classified as problematic. Affected is an unknown function of the component HTML Form Handler. The manipulation leads to inclusion of sensitive information in source code. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en Vivotek NVR ND8422P, NVR ND9525P y NVR ND9541P 2.4.0.204/3.3.0.104/4.2.0.101. Se ha clasificado como problem\u00e1tica. Se ve afectada una funci\u00f3n desconocida del componente HTML Form Handler. La manipulaci\u00f3n conlleva la inclusi\u00f3n de informaci\u00f3n confidencial en el c\u00f3digo fuente. Es posible ejecutar el ataque de forma remota. Se ha hecho p\u00fablico el exploit y puede que sea utilizado. Se contact\u00f3 al proveedor con antelaci\u00f3n para informarle sobre esta divulgaci\u00f3n, pero no respondi\u00f3."}], "id": "CVE-2025-3403", "lastModified": "2026-06-17T09:19:53.640", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "MULTIPLE", "availabilityImpact": "NONE", "baseScore": 3.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:M/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 6.4, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-3403", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-04-08T15:46:08.310718Z", "version": "2.0.3"}}]}, "published": "2025-04-08T03:15:16.670", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/lfparizzi/CVE-VIVOTEK-ID/blob/main/README.md"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.303648"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.303648"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.543589"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/lfparizzi/CVE-VIVOTEK-ID/blob/main/README.md"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-540"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{}