CVE-2025-3329

Consumer Comanda Mobile Restaurant Order cleartext transmission

State: Published
Severity: 2.3 Low
Published: Apr 7, 2025
Updated: Apr 7, 2025
Reserved: Apr 6, 2025

Description

A vulnerability classified as problematic has been found in Consumer Comanda Mobile up to 14.9.3.2/15.0.0.8. This affects an unknown part of the component Restaurant Order Handler. The manipulation of the argument Login/Password leads to cleartext transmission of sensitive information. The attack can only be initiated within the local network. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.

Scores

CVSS	Score	Vector	Source
4.0	2.3 Low	CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	VulDB
3.1	3.1 Low	CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N	VulDB
3.0	3.1 Low	CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N	VulDB
2.0	1.8 Low	AV:A/AC:H/Au:N/C:P/I:N/A:N	VulDB

Weaknesses

CWE-319 Cleartext Transmission of Sensitive Information
CWE-310 Cryptographic Issues

Affected Products

Product	Versions
Comanda MobileConsumer	14.9.3.0Affected 14.9.3.1Affected 14.9.3.2Affected 15.0.0.0Affected 15.0.0.1Affected 15.0.0.2Affected 15.0.0.3Affected 15.0.0.4Affected 15.0.0.5Affected 15.0.0.6Affected 15.0.0.7Affected 15.0.0.8Affected

References

VDB-303543 | Consumer Comanda Mobile Restaurant Order cleartext transmissionvdb-entrytechnical-description
VDB-303543 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #551790 | Consumer Comanda Mobile 14.7.1.4 – 15.0.0.8 Improper Authorizationthird-party-advisory
https://medium.com/@davimouar/from-order-to-exploit-a-deep-dive-into-restaurant-network-security-64aeaf3a6f64exploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.