Log in Start free

Vulnerability · Published Apr 8, 2025 · Assigned by VulDB

CVE-2025-3403Vivotek NVR ND8422P/NVR ND9525P/NVR ND9541P HTML Form sensitive information in source

Low 2.7

In plain English

A low-severity information exposure in NVR ND8422P from Vivotek. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)2.7Low
Exploit odds (30 days)0.4%top 67.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in Vivotek NVR ND8422P, NVR ND9525P and NVR ND9541P 2.4.0.204/3.3.0.104/4.2.0.101. It has been classified as problematic. Affected is an unknown function of the component HTML Form Handler. The manipulation leads to inclusion of sensitive information in source code. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

VendorProductVersions
Vivotek NVR ND8422P 2.4.0.2043.3.0.1044.2.0.101
Vivotek NVR ND9525P 2.4.0.2043.3.0.1044.2.0.101
Vivotek NVR ND9541P 2.4.0.2043.3.0.1044.2.0.101

Weakness: CWE-540, CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

References