CVE-2025-2189CWE-312

Information Disclosure Vulnerability in Tinxy Smart Devices

Medium · published March 11, 2025

CVSS v4.0
5.1
EPSS
0%
Percentile
3.7
In the wild
Unconfirmed
What it is

This vulnerability exists in the Tinxy smart devices due to storage of credentials in plaintext within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the plaintext credentials stored on the vulnerable device.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00148 · 3.7th percentile
Weakness
CWE-312 · Cleartext Storage of Sensitive Information
Published
2025-03-11T11:40Z
EPSS history
Timeline
  • 11 MAR 11:40Z
    Information Disclosure Vulnerability in Tinxy Smart Devices
    cvelistv5