PT-2025-28185 · Twilio+1 · Twilio Api+1

Jackcaplin · Published 2025-07-07 · Updated 2025-07-07 · CVE-2025-52492

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Paxton10 versions prior to 4.6 SR6

Description: A vulnerability has been discovered in the firmware of Paxton10, where the firmware file, rootfs.tar.gz, contains hard-coded credentials for the Twilio API. A remote attacker who obtains a copy of the firmware can extract these credentials, potentially gaining unauthorized access to the associated Twilio account. This could lead to information disclosure, potential service disruption, and unauthorized use of the Twilio services.

Recommendations: For versions prior to 4.6 SR6, update to version 4.6 SR6 or later to resolve the issue. As a temporary workaround, consider restricting access to the Twilio API until the update is applied. Avoid using the hard-coded credentials in the firmware file until the issue is resolved.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-52492

Affected Products

Paxton10

Twilio Api

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-52492 · Security Note
• https://twitter.com/CVEnew/status/1942246219184800092 · Twitter Post
• https://gist.github.com/jackcaplin/0dfb7ef428b8ade5de4396dd753cd894 · Note
• https://twitter.com/VulmonFeeds/status/1942353142483505434 · Twitter Post
• https://paxton-access.co.uk · Note