PT-2025-26953 · Hunt Electronic · Hunt Electronic Hybrid Dvr

An-Wei Kung + 4 · Published 2025-06-26 · Updated 2025-07-01 · CVE-2025-6561

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Hunt Electronic Hybrid DVR models (HBF-09KD and HBF-16NK)

Description: The issue allows unauthenticated remote attackers to directly access a system configuration file and obtain plaintext administrator credentials. This is an Exposure of Sensitive Information vulnerability.

Recommendations: For HBF-09KD and HBF-16NK models, consider restricting access to the system configuration file until a patch is available. As a temporary workaround, avoid using plaintext administrator credentials in the affected system until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-497

CWE-256

Related Identifiers

BDU:2025-14630

CVE-2025-6561

Affected Products

Hunt Electronic Hybrid Dvr

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2025-6561 · Security Note
• https://bdu.fstec.ru/vul/2025-14630 · Security Note
• https://twitter.com/CVEnew/status/1938213322978996411 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1938403222911373412 · Twitter Post
• https://twitter.com/cracbot/status/1940002494718923013 · Twitter Post
• https://t.me/pentestingnews/63495 · Telegram Post
• https://t.me/cvenotify/126735 · Telegram Post
• https://twitter.com/fridaysecurity/status/1938404402563355000 · Twitter Post
• https://twitter.com/TweetThreatNews/status/1938711105037066539 · Twitter Post
• https://twcert.org.tw/en/cp-139-10200-6b567-2.html · Note
• https://twcert.org.tw/tw/cp-132-10199-9c5c6-1.html · Note
• https://twitter.com/VulmonFeeds/status/1938215779486314542 · Twitter Post
• https://twitter.com/TweetThreatNews/status/1939164090703695880 · Twitter Post