Riskcovery

CVE-2025-2189

Information Disclosure Vulnerability in Tinxy Smart Devices

State
Published
Severity
5.1 Medium
Published
Mar 11, 2025
Updated
Mar 11, 2025
Reserved
Mar 11, 2025

Read the record on cve.org

Description

This vulnerability exists in the Tinxy smart devices due to storage of credentials in plaintext within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the plaintext credentials stored on the vulnerable device.

Scores

CVSSScoreVectorSource
4.05.1 MediumCVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:NCERT-In

Weaknesses

  • CWE-312 Cleartext Storage of Sensitive Information

Affected Products

ProductVersions
Tinxy Wi-Fi Lock Controller v1 RFMogify Infotech
  • all versionsAffected
Tinxy Door Lock with Wi-Fi ControllerMogify Infotech
  • all versionsAffected
Tinxy 1 Node 10A and 16A Smart Wi-Fi SwitchesMogify Infotech
  • all versionsAffected
Tinxy 2, 4 and 6 Node Smart Wi-Fi SwitchesMogify Infotech
  • all versionsAffected
Tinxy Smart 15 Watts 3 in 1 Square Panel Ceiling LightMogify Infotech
  • all versionsAffected
Tinxy Smart 8 Watts 3 in 1 Round Panel Ceiling LightMogify Infotech
  • all versionsAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.