CVE-2025-52492

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-52492
A vulnerability has been discovered in the firmware of Paxton Paxton10 before 4.6 SR6. The firmware file, rootfs.tar.gz, contains hard-coded credentials for the Twilio API. A remote attacker who obtains a copy of the firmware can extract these credentials. This could allow the attacker to gain unauthorized access to the associated Twilio account, leading to information disclosure, potential service disruption, and unauthorized use of the Twilio services.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://gist.github.com/jackcaplin/0dfb7ef428b8ade5de4396dd753cd894
https://paxton-access.co.uk
Configurations

No configuration.

History

08 Jul 2025, 18:15

Type Values Removed Values Added
CWE CWE-798
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

08 Jul 2025, 16:18

Type Values Removed Values Added
Summary
  • (es) Se ha descubierto una vulnerabilidad en el firmware de Paxton Paxton10 anterior a la versión 4.6 SR6. El archivo de firmware, rootfs.tar.gz, contiene credenciales predefinidas para la API de Twilio. Un atacante remoto que obtenga una copia del firmware puede extraer estas credenciales. Esto podría permitirle obtener acceso no autorizado a la cuenta de Twilio asociada, lo que podría provocar la divulgación de información, la posible interrupción del servicio y el uso no autorizado de los servicios de Twilio.

07 Jul 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-07 16:15

Updated : 2025-07-08 18:15

NVD link : CVE-2025-52492

Mitre link : CVE-2025-52492

CVE.ORG link : CVE-2025-52492

JSON object : View

Products Affected

No product.

CWE
CWE-798

Use of Hard-coded Credentials