CVE-2025-6521CWE-327

TrendMakers Sight Bulb Pro Use of a Broken or Risky Cryptographic Algorithm

Medium · published June 27, 2025

CVSS v4.0
6.8
EPSS
0%
Percentile
0.4
In the wild
Unconfirmed
What it is

During the initial setup of the device the user connects to an access

point broadcast by the Sight Bulb Pro. During the negotiation, AES

Encryption keys are passed in cleartext. If captured, an attacker may be

able to decrypt communications between the management app and the Sight

Bulb Pro which may include sensitive information such as network

credentials.

The record
Technical detail
CVSS v4.0
6.8 · MEDIUM
Vector
CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00089 · 0.4th percentile
Weakness
CWE-327 · Use of a Broken or Risky Cryptographic Algorithm
Published
2025-06-27T17:06Z
EPSS history
Timeline
  • 27 JUN 17:06Z
    TrendMakers Sight Bulb Pro Use of a Broken or Risky Cryptographic Algorithm
    cvelistv5