CVE-2025-10880CWE-522

CVE-2025-10880

High · published September 25, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
23.4
In the wild
Unconfirmed
What it is

All versions of Dingtian DT-R002 are vulnerable to an Insufficiently Protected Credentials vulnerability that could allow an attacker to extract the proprietary "Dingtian Binary" protocol password by sending an unauthenticated GET request.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00317 · 23.4th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2025-09-25T21:15Z
Affected products (1)
ProductVersionsFixed in
dingtian-tech/dt-r002_firmwareall versions—
References (1)
https://www.cisa.gov/news-events/ics-advisories/icsa-25-268-01 · [email protected]
EPSS history
Timeline
  • 25 SEP 16:32Z
    Insufficiently Protected Credentials in Dingtian DT-R002
    cvelistv5