CVE-2025-47419CWE-319

Non-Secure Access

Critical · published May 6, 2025

CVSS v4.0
10.0
EPSS
0%
Percentile
21.0
In the wild
Unconfirmed
What it is

Cleartext Transmission of Sensitive Information vulnerability in Crestron Automate VX allows Sniffing Network Traffic.

The device allows Web UI and API access over non-secure network ports which exposes sensitive information such as user passwords.

This issue affects Automate VX: from 5.6.8161.21536 through 6.4.0.49.

The record
Technical detail
CVSS v4.0
10.0 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00295 · 21.0th percentile
Weakness
CWE-319 · Cleartext Transmission of Sensitive Information
Published
2025-05-06T20:52Z
EPSS history
Timeline
  • 06 MAY 20:52Z
    Non-Secure Access
    cvelistv5