CVE-2025-61234

Incorrect access control on Dataphone A920 v2025.07.161103 exposes a service on port 8888 by default on the local network without authentication

High · published October 29, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
26.7
In the wild
Unconfirmed
What it is

⚡ A default open port on the Dataphone A920 could let attackers waltz right in without needing a password! 😱 Think of it like a restaurant leaving their back door wide open during off-hours, inviting anyone with an appetite for mischief to stroll in and poke around the kitchen. This vulnerability means unauthorized users could access sensitive device functions without any checks! An attacker could connect to the device on port 8888 and potentially manipulate its operations, exposing sensitive information and compromising security. This could lead to unauthorized access to customer data or even tampering with financial transactions. It's a recipe for disaster!

Put simply

Think of it like a restaurant leaving their back door wide open during off-hours, inviting anyone with an appetite for mischief to stroll in and poke around the kitchen. This vulnerability means unauthorized users could access sensitive device functions without any checks! This vulnerability stems from incorrect access control on the Dataphone A920, allowing unauthenticated access to a service on port 8888. It also exposes details through error responses, revealing sensitive headers and the build version of the device.

What to do

An attacker could connect to the device on port 8888 and potentially manipulate its operations, exposing sensitive information and compromising security. This could lead to unauthorized access to customer data or even tampering with financial transactions. It's a recipe for disaster! To mitigate this risk, change the default port settings immediately and implement strong authentication measures. Additionally, consider restricting access to trusted IP addresses only to further protect the device from unauthorized access. You've got this! With these steps, you can lock down the Dataphone A920 and safeguard your network! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00344 · 26.7th percentile
Published
2025-10-29T00:00Z
EPSS history
Timeline
  • 29 OCT 00:00Z
    Incorrect access control on Dataphone A920 v2025.07.161103 exposes a service on port 8888 by default on the local network without authentication
    cvelistv5