CVE-2025-11942CWE-287CWE-306

CVE-2025-11942

High · published October 19, 2025

CVSS v3.1
7.3
EPSS
1%
Percentile
65.1
In the wild
Unconfirmed
What it is

⚠️ A sneaky flaw in the 70mai X200 could leave your device open for business! An attacker can exploit it remotely, bypassing authentication entirely.🔥 Think of it like a hotel with a front desk that just hands out keys without checking IDs — anyone can waltz in and access rooms without proof of who they are. This vulnerability could allow an unauthorized individual to connect to your device and manipulate settings or access sensitive information, potentially leading to a privacy breach. While the risk isn't labeled as critical, leaving it unchecked could lead to some unwanted surprises.

Put simply

Think of it like a hotel with a front desk that just hands out keys without checking IDs — anyone can waltz in and access rooms without proof of who they are. The issue resides in the Pairing component of the 70mai X200, where an unknown function fails to authenticate users properly, allowing remote exploitation without any login requirements.

What to do

This vulnerability could allow an unauthorized individual to connect to your device and manipulate settings or access sensitive information, potentially leading to a privacy breach. While the risk isn't labeled as critical, leaving it unchecked could lead to some unwanted surprises. To protect yourself, update your device to the latest firmware version as soon as it's available to patch this vulnerability. Additionally, review your device settings and consider disabling remote access until you ensure you're on the latest version. 📱 You've got this! Stay vigilant and secure your devices, and remember: being proactive is the best defense! 🛡️

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01092 · 65.1th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-306 · Missing Authentication for Critical Function
Published
2025-10-19T20:15Z
Affected products (1)
ProductVersionsFixed in
70mai/x200_firmware≤ 2025-10-10—
References (4)
EPSS history
Timeline
  • 19 OCT 16:02Z
    70mai X200 Pairing missing authentication
    cvelistv5