CVE-2025-6980CWE-200information-disclosure

CVE-2025-6980

High · published October 23, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
40.7
In the wild
Unconfirmed
What it is

⚡ A misconfigured Captive Portal might just spill your secrets! Anyone connecting could access sensitive information, like a designated driver accidentally revealing private texts while taking a ride. 🚗💨 Think of a Captive Portal as a trendy café that requires you to log in to access Wi-Fi. If the barista leaves the register open and visible, anyone walking by could check out your personal orders, including those embarrassing messages to your friend. If exploited, an attacker could snoop on sensitive data like personal user information or login credentials. This could lead to account takeovers or unauthorized access to private systems—absolutely devastating for your security!

Put simply

Think of a Captive Portal as a trendy café that requires you to log in to access Wi-Fi. If the barista leaves the register open and visible, anyone walking by could check out your personal orders, including those embarrassing messages to your friend. This vulnerability arises from a lack of proper access controls in the Captive Portal, allowing connected users to browse sensitive information inadvertently exposed by the service.

What to do

If exploited, an attacker could snoop on sensitive data like personal user information or login credentials. This could lead to account takeovers or unauthorized access to private systems—absolutely devastating for your security! To mitigate this risk, ensure that your Captive Portal has strict access controls in place, including proper session management and data encryption. Regularly audit your configurations and user permissions to prevent unauthorized access. Patch any known vulnerabilities as they are released. You've got this! With a few adjustments, you'll have your Captive Portal secure and your data safe in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00483 · 40.7th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2025-10-23T23:15Z
References (1)
EPSS history
Timeline
  • 23 OCT 18:41Z
    Captive Portal can expose sensitive information
    cvelistv5