PT-2025-16552 · Delta Electronics · Commgr

Published 2025-04-15 · Updated 2025-06-18 · CVE-2025-3495

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Delta Electronics COMMGR versions 1 through 2

Description The issue is related to insufficiently randomized values used to generate session IDs, which could allow an attacker to brute force a session ID and potentially load and execute arbitrary code. This is due to the use of a cryptographically weak pseudo-random number generator (PRNG).

Recommendations For versions 1 and 2, update the software to use a cryptographically secure pseudo-random number generator (PRNG) to generate session IDs. As a temporary workaround, consider implementing additional authentication measures to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-338

Related Identifiers

BDU:2025-09785

CVE-2025-3495

ZDI-25-397

Affected Products

Commgr

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-3495 · Security Note
• https://bdu.fstec.ru/vul/2025-09785 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-25-397 · Security Note
• https://t.me/cvedetector/23048 · Telegram Post
• https://t.me/latest_high_impact_cve/2145 · Telegram Post
• https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00005_COMMGR%20-%20Insufficient%20Randomization%20Authentication%20Bypass_v1.pdf · Note
• https://twitter.com/CveFindCom/status/1912348336792666336 · Twitter Post
• https://twitter.com/CVEnew/status/1912359792691028071 · Twitter Post
• https://twitter.com/syedaquib77/status/1912601664336597457 · Twitter Post
• https://t.me/cvetracker/21710 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-25-105-07 · Note
• https://twitter.com/TheZDIBugs/status/1935420962859602092 · Twitter Post