PT-2025-45377 · Pypi+1 · Mqtt+1

Published 2025-11-06 · Updated 2025-12-03 · CVE-2025-12790

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Rubygem MQTT (affected versions not specified)

Description The Rubygem MQTT package did not have hostname validation enabled by default, which could allow for a Man-in-the-Middle (MITM) attack. This means a malicious actor could potentially intercept communication between systems using the MQTT package.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-29

Related Identifiers

BDU:2025-15584

CVE-2025-12790

GHSA-9C5Q-W6GR-FXCQ

Affected Products

Mqtt

Red Os

References · 16

• https://osv.dev/vulnerability/CVE-2025-12790 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15584 · Security Note
• https://osv.dev/vulnerability/GHSA-9c5q-w6gr-fxcq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12790 · Security Note
• https://github.com/njh/ruby-mqtt/blob/main/NEWS.md#ruby-mqtt-version-070-2025-10-29 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2413004 · Note
• https://twitter.com/CVEnew/status/1986577138838094095 · Twitter Post
• http://github.com/njh/ruby-mqtt · Note
• https://access.redhat.com/security/cve/CVE-2025-12790 · Note
• https://reddit.com/r/VulnMatter/comments/1oqv4uj/resumen_diario_de_vulnerabilidades_07112025 · Reddit Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-rubygem-mqtt-cve-2025-12790 · Note
• https://reddit.com/r/VulnMatter/comments/1ov498g/resumen_diario_de_vulnerabilidades_12112025 · Reddit Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/uyazvimost-rubygem-mqtt-cve-2025-12790/?sphrase_id=1371002 · Note
• https://reddit.com/r/VulnMatter/comments/1otcofi/resumen_diario_de_vulnerabilidades_10112025 · Reddit Post
• https://twitter.com/VulmonFeeds/status/1986631553913373050 · Twitter Post