CVE-2025-25037CWE-200

Aquatronica Controller System Complete Information Disclosure

Critical · published June 20, 2025

CVSS v4.0
9.3
EPSS
2%
Percentile
75.2
In the wild
Unconfirmed
What it is

An information disclosure vulnerability exists in Aquatronica Controller System firmware versions <= 5.1.6 and web interface versions <= 2.0. The tcp.php endpoint fails to restrict unauthenticated access, allowing remote attackers to issue crafted POST requests and retrieve sensitive configuration data, including plaintext administrative credentials. Exploitation of this flaw can lead to full compromise of the system, enabling unauthorized manipulation of connected devices and aquarium parameters.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
EPSS
0.01574 · 75.2th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2025-06-20T18:35Z
EPSS history
Timeline
  • 20 JUN 18:35Z
    Aquatronica Controller System Complete Information Disclosure
    cvelistv5