PT-2025-45604 · Jumo · Jumo Varitron300

Published 2025-11-10 · Updated 2025-11-14 · CVE-2025-41731

Positive Technologies · (AI Summary)

CVSS v3.1

7.4

7.4

High

Base vector

AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jumo variTRON300 (affected versions not specified)

Description A flaw exists in the password generation algorithm when accessing the debug interface. An unauthenticated local attacker who knows the password generation timeframe may be able to brute force the password and gain root access to the device if the debug interface remains enabled. The issue relates to insufficient entropy in the pseudorandom number generator (PRNG) used for password creation.

Recommendations Disable the debug interface to prevent exploitation. Monitor access to the debug interface for any suspicious activity.

Fix

Weakness Enumeration

CWE-338

Related Identifiers

BDU:2026-00038

CVE-2025-41731

Affected Products

Jumo Varitron300

References · 11

• https://bdu.fstec.ru/vul/2026-00038 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-41731 · Security Note
• https://twitter.com/offseq/status/1987807691440345308 · Twitter Post
• https://jumo.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-086.json · Note
• https://t.me/CVEtracker/36899 · Telegram Post
• https://twitter.com/AnonOzzyDude/status/1987809729070899608 · Twitter Post
• https://certvde.com/en/advisories/VDE-2025-086 · Note
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-45604 · Note
• https://t.me/cveNotify/142250 · Telegram Post
• https://twitter.com/CVEnew/status/1987798130813796654 · Twitter Post
• https://twitter.com/cracbot/status/1989287253156471200 · Twitter Post