CVE-2025-11852CWE-287CWE-306

CVE-2025-11852

Medium · published October 16, 2025

CVSS v3.1
5.3
EPSS
1%
Percentile
47.2
In the wild
Unconfirmed
What it is

A vulnerability was found in Apeman ID71 218.53.203.117. The impacted element is an unknown function of the file /onvif/device_service of the component ONVIF Service. Performing manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00583 · 47.2th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-306 · Missing Authentication for Critical Function
Published
2025-10-16T23:15Z
References (4)
https://github.com/juliourena/APEMAN-Camera-PoCs/blob/main/RTSP/RTSP_Unauthenticated.md · [email protected]https://vuldb.com/?ctiid.328798 · [email protected]https://vuldb.com/?id.328798 · [email protected]https://vuldb.com/?submit.668899 · [email protected]
EPSS history
Timeline
  • 16 OCT 19:02Z
    Apeman ID71 ONVIF Service device_service missing authentication
    cvelistv5