PT-2025-47193 · Unknown · Freebox Mini 4K+4

Published 2025-11-17 · Updated 2026-02-04 · CVE-2025-63292

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Freebox v5 HD version 1.7.20 Freebox v5 Crystal version 1.7.20 Freebox v6 Révolution r1–r3 versions 4.7.x Freebox Mini 4K versions 4.7.x Freebox One versions 4.7.x

Description Freebox devices expose subscribers' IMSI identifiers in plaintext during the initial phase of EAP-SIM authentication over the FreeWifi secure network. Specifically, during the EAP-Response/Identity exchange, the subscriber's full Network Access Identifier (NAI), which contains the raw IMSI, is transmitted without encryption, tunneling, or pseudonymization. An attacker within Wi-Fi range (approximately 100 meters) can passively capture these frames without needing user interaction or elevated privileges. The disclosed IMSI allows for device tracking, subscriber correlation, and long-term monitoring of user presence near broadcasting Freebox devices.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2025-63292

Affected Products

Freebox Mini 4K

Freebox One

Freebox V5 Crystal

Freebox V5 Hd

Freebox V6 Révolution

References · 7

• 🔥 https://gist.github.com/7h30th3r0n3/1a0fadb19f1528e3d3f6bad9f680c3b0#file-cve-2025-63292-frebox-imsi-md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-63292 · Security Note
• https://osv.dev/vulnerability/CVE-2025-63292 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1990672259317416319 · Twitter Post
• https://t.me/cveNotify/150907 · Telegram Post
• https://7h30th3r0n3.fr/the-vulnerability-that-killed-freewifi_secure · Note
• https://t.me/CVEtracker/37534 · Telegram Post