CVE-2025-64385criticalCWE-20

CVE-2025-64385: critical vulnerability in Circutor TCPRS1plus

INCORRECT SECURITY VALIDATION IN SENDING UDP FRAMES

Published · Updated

Follow this CVE+ Monitor TCPRS1plus

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.2epss 0.4%
The equipment initially can be configured using the manufacturer's application, by Wi-Fi, by the web server or with the manufacturer’s software. Using the manufacturer's software, the device can be configured via UDP. Analyzing this communication, it has been observed that any aspect of the initial configuration can be changed by means of the device's MAC without the need for authentication.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H
Affected products
Circutor · TCPRS1plus
Related CVEs — Circutor TCPRS1plus

In the same product, most dangerous first.

CVE-2025-64387MEDIUMCLICKJACKINGEPSS 0.4%CVE-2025-64388CRITICALDenial of service through specific packetsEPSS 0.4%CVE-2025-64386HIGHHIJACKING OF THE TOKEN AND GAINING ACCESSEPSS 0.4%CVE-2025-64389HIGHEXCHANGE OF SENSITIVE INFORMATION IN CLEAR TEXTEPSS 0.2%