CVE-2025-4286

Intelbras InControl Dispositivos Edição Page credentials storage

View on CVE.org
Published May 5, 2025 CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was found in Intelbras InControl up to 2.21.59. It has been classified as problematic. Affected is an unknown function of the component Dispositivos Edição Page. The manipulation of the argument Senha de Comunicação leads to unprotected storage of credentials. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. According to the vendor this issue should be fixed in a later release.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-13416 A vulnerability was found in Intelbras InControl up to 2.21.59. It has been classified as problematic. Affected is an unknown function of the component Dispositivos Edição Page. The manipulation of the argument Senha de Comunicação leads to unprotected storage of credentials. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. According to the vendor this issue should be fixed in a later release.
History
Type Values Removed Values Added
First Time appeared Intelbras incontrol Web
CPEs cpe:2.3:a:intelbras:incontrol_web:*:*:*:*:*:*:*:*
Vendors & Products Intelbras incontrol Web
Type Values Removed Values Added
Metrics epss

{'score': 0.00035}

 epss

{'score': 0.00037}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was found in Intelbras InControl up to 2.21.59. It has been classified as problematic. Affected is an unknown function of the component Dispositivos Edição Page. The manipulation of the argument Senha de Comunicação leads to unprotected storage of credentials. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. According to the vendor this issue should be fixed in a later release.
Title Intelbras InControl Dispositivos Edição Page credentials storage
Weaknesses CWE-255
CWE-256
References
Metrics cvssV2_0

{'score': 3.3, 'vector': 'AV:N/AC:L/Au:M/C:P/I:N/A:N'}

cvssV3_0

{'score': 2.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N'}

cvssV3_1

{'score': 2.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
May 5, 2025, 8:05 PM
Reserved
May 5, 2025, 11:46 AM

View source JSON

Updated
May 5, 2025, 8:04 PM

JSON

Status
Analyzed
Published
May 5, 2025, 8:15 PM
Modified
Jun 17, 2026, 9:32 AM

View source JSON

No data.

Updated
Jun 24, 2025, 9:44 AM

JSON