PT-2025-47500 · Newtec · Celoxa504+2

Published 2025-11-19 · Updated 2025-11-20 · CVE-2025-63210

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Newtec Celox UHD versions celox-21.6.13

Description The Newtec Celox UHD (models CELOXA504, CELOXA820) is affected by an authentication bypass. An attacker can gain Superuser or Operator access without valid credentials by modifying intercepted responses from the /celoxservice endpoint during the loginWithUserName flow. This is achieved by injecting a forged response body.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the /celoxservice endpoint.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-302

CWE-287

CWE-303

Related Identifiers

CVE-2025-63210

Affected Products

Celoxa504

Celoxa820

Newtec Celox Uhd

References · 8

• 🔥 https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63210_Newtec%20Celox%20UHD%20Authentication%20Bypass%20_%20Privilege%20Escalation · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-63210 · Security Note
• https://osv.dev/vulnerability/CVE-2025-63210 · Vendor Advisory
• https://twitter.com/CVEnew/status/1991409497147941243 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1991273840324853821 · Twitter Post
• https://newtec.com · Note
• https://t.me/CVEtracker/37770 · Telegram Post
• https://twitter.com/CveFindCom/status/1991245379728285834 · Twitter Post