CVE-2025-4364 - Vulnerability Details - OpenCVE

The affected products could allow an unauthenticated attacker to access system information that could enable further access to sensitive files and obtain administrative credentials.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-11

History

Tue, 20 May 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 20 May 2025 18:00:00 +0000

Type	Values Removed	Values Added
Description		The affected products could allow an unauthenticated attacker to access system information that could enable further access to sensitive files and obtain administrative credentials.
Title		Exposure of Sensitive System Information to an Unauthorized Control Sphere
Weaknesses		CWE-497
References		https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-11
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2025-05-20T17:48:02.341Z

Updated: 2025-05-20T18:16:37.144Z

Reserved: 2025-05-05T17:29:44.355Z

Link: CVE-2025-4364

Vulnrichment

Updated: 2025-05-20T18:16:33.529Z

NVD

Status : Awaiting Analysis

Published: 2025-05-20T18:15:47.807

Modified: 2025-05-21T20:24:58.133

Link: CVE-2025-4364

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-4364", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2025-05-05T17:29:44.355Z", "datePublished": "2025-05-20T17:48:02.341Z", "dateUpdated": "2025-05-20T18:16:37.144Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Fleet Management System", "vendor": "Assured Telematics Inc.", "versions": [{"lessThan": "February 6th, 2025", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Nicholas Michael Kloster"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>The affected products could allow an unauthenticated attacker to access system information that could enable further access to sensitive files and obtain administrative credentials.</p><br>"}], "value": "The affected products could allow an unauthenticated attacker to access system information that could enable further access to sensitive files and obtain administrative credentials."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-497", "description": "CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2025-05-20T17:48:02.341Z"}, "references": [{"tags": ["government-resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-11"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Assured Telematics reports that they have fixed the exposure of sensitive information.</p><p><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.assuredtelematics.com/contact/\">Contact Assured Telematics for more information</a></p>\n\n<br>"}], "value": "Assured Telematics reports that they have fixed the exposure of sensitive information.\n\n Contact Assured Telematics for more information https://www.assuredtelematics.com/contact/"}], "source": {"discovery": "UNKNOWN"}, "title": "Exposure of Sensitive System Information to an Unauthorized Control Sphere", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-20T18:16:31.672927Z", "id": "CVE-2025-4364", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-20T18:16:37.144Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-4364", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-20T18:16:31.672927Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-20T18:16:33.529Z"}}], "cna": {"title": "Exposure of Sensitive System Information to an Unauthorized Control Sphere", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Nicholas Michael Kloster"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Assured Telematics Inc.", "product": "Fleet Management System", "versions": [{"status": "affected", "version": "0", "lessThan": "February 6th, 2025", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Assured Telematics reports that they have fixed the exposure of sensitive information.\n\n Contact Assured Telematics for more information https://www.assuredtelematics.com/contact/", "supportingMedia": [{"type": "text/html", "value": "<p>Assured Telematics reports that they have fixed the exposure of sensitive information.</p><p><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.assuredtelematics.com/contact/\">Contact Assured Telematics for more information</a></p>\n\n<br>", "base64": false}]}], "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-11", "tags": ["government-resource"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The affected products could allow an unauthenticated attacker to access system information that could enable further access to sensitive files and obtain administrative credentials.", "supportingMedia": [{"type": "text/html", "value": "<p>The affected products could allow an unauthenticated attacker to access system information that could enable further access to sensitive files and obtain administrative credentials.</p><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-497", "description": "CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2025-05-20T17:48:02.341Z"}}}, "cveMetadata": {"cveId": "CVE-2025-4364", "state": "PUBLISHED", "dateUpdated": "2025-05-20T18:16:37.144Z", "dateReserved": "2025-05-05T17:29:44.355Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2025-05-20T17:48:02.341Z", "assignerShortName": "icscert"}, "dataVersion": "5.1"}