CVE-2025-9139

Katalog CVE

CVSS 6.5 · Medium EPSS 0,33%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada scada-lts. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability was determined in Scada-LTS 2.7.8.1. Affected by this vulnerability is an unknown functionality of the file /Scada-LTS/dwr/call/plaincall/WatchListDwr.init.dwr. Executing manipulation can lead to information disclosure. The attack may be performed from a remote location. The exploit has been publicly disclosed and may be utilized. The vendor explains: "[T]he risks of indicated vulnerabilities seem to be minimal as all scenarios likely require admin permissions. Moreover, regardless our team fixes those vulnerabilities - the overall risk change to the user due to malicious admin actions will not be lower."

Rincian

Terbit di NVD

19 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-284: Improper Access Control

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://vuldb.com/?id.320519 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.621062 advisory pihak ketiga · vdb entry
• https://github.com/CVE-Hunters/CVE/blob/main/Scada-LTS/%20CVE-2025-9139.md broken link
• https://vuldb.com/?ctiid.320519 permissions required · vdb entry
• https://github.com/CVE-Hunters/CVE/blob/main/Scada-LTS/Sensitive%20User%20Information%20Disclosure%20via%20Wat... broken link