CVE-2025-4384

The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet become valid. This allows malicious devices to present certificates that are not rejected properly. The use of a client certificate reduces the risk for random devices to take advantage of this flaw.

CVSS

No CVSS.

References

Link	Resource
https://www.pcvue.com/security/#SB2025-3

Configurations

No configuration.

History

07 May 2025, 14:13

Type	Values Removed	Values Added
Summary		(es) El complemento MQTT de PcVue no verifica que el certificado de un dispositivo remoto no haya caducado o no sea válido. Esto permite que dispositivos maliciosos presenten certificados que no se rechazan correctamente. El uso de un certificado de cliente reduce el riesgo de que dispositivos aleatorios se aprovechen de esta vulnerabilidad.

06 May 2025, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-05-06 16:15

Updated : 2025-05-07 14:13

NVD link : CVE-2025-4384

Mitre link : CVE-2025-4384

CVE.ORG link : CVE-2025-4384

JSON object : View

Products Affected

No product.

CWE

CWE-298

Improper Validation of Certificate Expiration

{"id": "CVE-2025-4384", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "USER", "baseScore": 6.0, "Automatable": "NO", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:M/U:Green", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "GREEN", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "MODERATE", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-05-06T16:15:32.340", "references": [{"url": "https://www.pcvue.com/security/#SB2025-3", "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932", "description": [{"lang": "en", "value": "CWE-298"}]}], "descriptions": [{"lang": "en", "value": "The MQTT add-on of PcVue fails to verify that a remote device\u2019s certificate has not already expired or has not yet become valid. This allows malicious devices to present certificates that are not rejected properly.\n\nThe use of a client certificate reduces the risk for random devices to take advantage of this flaw."}, {"lang": "es", "value": "El complemento MQTT de PcVue no verifica que el certificado de un dispositivo remoto no haya caducado o no sea v\u00e1lido. Esto permite que dispositivos maliciosos presenten certificados que no se rechazan correctamente. El uso de un certificado de cliente reduce el riesgo de que dispositivos aleatorios se aprovechen de esta vulnerabilidad."}], "lastModified": "2025-05-07T14:13:20.483", "sourceIdentifier": "87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932"}