Vulnerability · Published Feb 23, 2025 · Assigned by VulDB
CVE-2025-1595Anhui Xufan Information Technology EasyCVR getbaseconfig information disclosure
Medium 5.3
In plain English
A medium-severity information exposure in EasyCVR from Anhui Xufan Information Technology. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
A vulnerability has been found in Anhui Xufan Information Technology EasyCVR up to 2.7.0 and classified as problematic. This vulnerability affects unknown code of the file /api/v1/getbaseconfig. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Anhui Xufan Information Technology | EasyCVR | 2.02.12.22.32.42.52.62.7 |
Weakness: CWE-200, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- VDB-296590 | Anhui Xufan Information Technology EasyCVR getbaseconfig information disclosure vdb-entry
- VDB-296590 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #497485 | 安徽旭帆信息科技有限公司 EasyCVR-视频管理平台 未知 Use of Java I/O third-party-advisory
- https://github.com/MH521/POC/blob/main/EasyCVR-%E8%A7%86%E9%A2%91%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0getbaseconfig%E6%8E%A5%E5%8F%A3%E6%9C%AA%E6%8E%88%E6%9D%83%E8%AE%BF%E9%97%AE.md exploit