PT-2025-40604 · Unknown+1 · Minecraft Rcon Terminal+1

Jaketcooper · Published 2025-10-03 · Updated 2025-10-04 · CVE-2025-61680

Positive Technologies (AI Summary)

CVSS v4.0

6.6

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Minecraft RCON Terminal versions 0.1.0 through 2.0.6

Description The Minecraft RCON Terminal VS Code extension improperly stores passwords in plaintext within the settings.json file using VS Code's configuration API. This affects versions used for Minecraft server management.

Recommendations Update to version 2.1.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-256

Related Identifiers

CVE-2025-61680

GHSA-4M33-HXQW-7J77

Affected Products

Minecraft Rcon Terminal

Vscode

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61680.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-61680 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61680 · Security Note
• https://github.com/jaketcooper/Minecraft-rcon/releases/tag/2.1.0 · Note
• https://github.com/jaketcooper/Minecraft-rcon/security/advisories/GHSA-4m33-hxqw-7j77 · Note
• https://github.com/jaketcooper/Minecraft-rcon/commit/31272b541482d095d1578855c2b571268eb9b877 · Note
• https://t.me/cveNotify/137377 · Telegram Post
• https://twitter.com/CVEnew/status/1974230565378207774 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1974321006287188438 · Twitter Post
• https://t.me/CVEtracker/34067 · Telegram Post