PT-2025-44625 · Circutor · Tcprs1Plus

Published 2025-10-31 · Updated 2025-10-31 · CVE-2025-64386

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. (affected versions not specified)

Description The web server allows an attacker to reuse an old session JWT token while a legitimate session is active, potentially leading to session hijacking. An attacker with the token can modify security parameters or steal the session without detection by the legitimate user. The equipment grants a JWT token for each connection, but a valid session can be hijacked. Additionally, the device's web server is susceptible to a Denial-of-Service (DoS) attack, causing it to stop functioning.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Clickjacking

Resource Exhaustion

Insufficient Session Expiration

Weakness Enumeration

CWE-1021

CWE-400

CWE-613

Related Identifiers

CVE-2025-64386

Affected Products

Tcprs1Plus

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-64386 · Security Note
• https://hackrtu.com/blog/cg-0day-en-003 · Note
• https://twitter.com/VulmonFeeds/status/1984359925410054288 · Twitter Post
• https://circutor.com/productos/iot-industrial-y-automatizacion/conversores-y-pasarelas/product/D80010. · Note
• https://twitter.com/CVEnew/status/1984277955368112584 · Twitter Post
• https://cds.thalesgroup.com/es/s21sec-about · Note
• https://cds.thalesgroup.com/es/s21sec · Note