PT-2025-47497 · R.V.R Elettronica · Tex Firmware+1

Published 2025-11-19 · Updated 2025-11-25 · CVE-2025-63207

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions R.V.R Elettronica TEX firmware TEXL-000400 and Web GUI TLAN-000400

Description The R.V.R Elettronica TEX product is affected by a broken access control issue. Improper authentication checks on the / Passwd.html API endpoint allow an attacker to send an unauthenticated POST request to modify the passwords for Admin, Operator, and User accounts, potentially leading to complete system compromise. Approximately 61 instances are reportedly exposed. The vulnerability allows attackers to reset all user passwords via a simple HTTP request.

Recommendations For firmware TEXL-000400 and Web GUI TLAN-000400, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-63207

Affected Products

Tex Web Gui

Tex Firmware

References · 14

• 🔥 https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63207_RVR%20Elettronica%20TEX%20Broken%20Access%20Control · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-63207 · Security Note
• https://osv.dev/vulnerability/CVE-2025-63207 · Vendor Advisory
• https://t.me/cveNotify/143475 · Telegram Post
• https://t.me/CSIRT_italia/2930 · Telegram Post
• https://twitter.com/zoomeye_team/status/1993219486007337388 · Twitter Post
• https://twitter.com/Karma_X_Inc/status/1993294179112268135 · Twitter Post
• https://t.me/CVEtracker/37767 · Telegram Post
• https://twitter.com/CVEnew/status/1991409494446780766 · Twitter Post
• https://t.me/CSIRT_italia/2931 · Telegram Post
• https://rvr.it/en · Note
• https://t.me/pentestingnews/71196 · Telegram Post
• https://twitter.com/fridaysecurity/status/1993114305915650301 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1993145671780835752 · Twitter Post