CVE-2025-3403
Vivotek NVR ND8422P/NVR ND9525P/NVR ND9541P HTML Form sensitive information in source
- State
- Published
- Severity
- 5.1 Medium
- Published
- Apr 8, 2025
- Updated
- Apr 8, 2025
- Reserved
- Apr 7, 2025
Description
A vulnerability was found in Vivotek NVR ND8422P, NVR ND9525P and NVR ND9541P 2.4.0.204/3.3.0.104/4.2.0.101. It has been classified as problematic. Affected is an unknown function of the component HTML Form Handler. The manipulation leads to inclusion of sensitive information in source code. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.1 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | VulDB |
| 3.1 | 2.7 Low | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N | VulDB |
| 3.0 | 2.7 Low | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N | VulDB |
| 2.0 | 3.3 Low | AV:N/AC:L/Au:M/C:P/I:N/A:N | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
NVR ND8422PVivotek |
|
NVR ND9525PVivotek |
|
NVR ND9541PVivotek |
|
References
- VDB-303648 | Vivotek NVR ND8422P/NVR ND9525P/NVR ND9541P HTML Form sensitive information in sourcevdb-entry
- VDB-303648 | CTI Indicators (IOB, IOC, TTP)signaturepermissions-required
- Submit #543589 | VIVOTEK NVR Core + 4.2.0.101 and below Cleartext Storage of Sensitive Information in GUIthird-party-advisory
- https://github.com/lfparizzi/CVE-VIVOTEK-ID/blob/main/README.mdexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.