PT-2025-34811 · Telpo · Telpo Mdm

Raiji1N · Published 2025-02-03 · Updated 2025-08-27 · CVE-2025-55443

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Telpo MDM versions 1.4.6 through 1.4.9

Description: The Telpo MDM Android platform stores sensitive administrator credentials and MQTT server connection details (IP/port) in plaintext within log files on the device's external storage. This allows attackers with access to these logs to authenticate to the MDM web platform and execute administrative operations, including device shutdown, factory reset, and software installation. Additionally, attackers can connect to the MQTT server to intercept or publish device data.

Recommendations: Update to a newer version of Telpo MDM that addresses this issue.

Fix

CSRF

Information Disclosure

Insertion into Log File

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-352

CWE-200

CWE-532

CWE-312

Related Identifiers

BDU:2025-07166

CVE-2025-55443

Affected Products

Telpo Mdm

References · 11

• https://cve.org/CVERecord?id=CVE-2025-55443 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-55443 · Security Note
• https://bdu.fstec.ru/vul/2025-07166 · Security Note
• https://osv.dev/vulnerability/CVE-2025-55443 · Vendor Advisory
• https://gist.github.com/raiji1n/a2ce5dd46c312e3bd38b9b2446b95860 · Note
• https://twitter.com/VulmonFeeds/status/1960468505007960174 · Twitter Post
• https://vuldb.com/?id.321478 · Note
• https://t.me/CVEtracker/30965 · Telegram Post
• https://twitter.com/CVEnew/status/1960426278630084714 · Twitter Post
• https://feedly.com/cve/CVE-2025-55443 · Note
• https://t.me/cveNotify/133692 · Telegram Post