CVE-2025-0681
New Rock Technologies Cloud Connected Devices Improper Neutralization of Wildcards or Matching Symbols
- State
- Published
- Severity
- 6.9 Medium
- Published
- Jan 30, 2025
- Updated
- Jan 30, 2025
- Reserved
- Jan 23, 2025
Description
The Cloud MQTT service of the affected products supports wildcard topic subscription which could allow an attacker to obtain sensitive information from tapping the service communications.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | icscert |
| 3.1 | 6.2 Medium | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | icscert |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
OM500 IP-PBXNew Rock Technologies |
|
MX8G VoIP GatewayNew Rock Technologies |
|
NRP1302/P Desktop IP PhoneNew Rock Technologies |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.