Vulnerability · Published May 6, 2025 · Assigned by Crestron
CVE-2025-47419Non-Secure Access
Critical 10.0
In plain English
A critical-severity security flaw in Automate VX from Crestron. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Severity (CVSS 4.0)10.0Critical
Exploit odds (30 days)0.3%top 77.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Cleartext Transmission of Sensitive Information vulnerability in Crestron Automate VX allows Sniffing Network Traffic. The device allows Web UI and API access over non-secure network ports which exposes sensitive information such as user passwords. This issue affects Automate VX: from 5.6.8161.21536 through 6.4.0.49.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Crestron | Automate VX | 5.6.8161.21536 – through 6.4.0.49 |
Weakness: CWE-319 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H