CVE-2025-3403CWE-200CWE-540

Vivotek NVR ND8422P/NVR ND9525P/NVR ND9541P HTML Form sensitive information in source

Medium · published April 8, 2025

CVSS v4.0
5.1
EPSS
0%
Percentile
30.5
In the wild
Unconfirmed
What it is

A vulnerability was found in Vivotek NVR ND8422P, NVR ND9525P and NVR ND9541P 2.4.0.204/3.3.0.104/4.2.0.101. It has been classified as problematic. Affected is an unknown function of the component HTML Form Handler. The manipulation leads to inclusion of sensitive information in source code. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00377 · 30.5th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-540 · Inclusion of Sensitive Information in Source Code
Published
2025-04-08T03:00Z
EPSS history
Timeline
  • 08 APR 03:00Z
    Vivotek NVR ND8422P/NVR ND9525P/NVR ND9541P HTML Form sensitive information in source
    cvelistv5