Vulnerability · Published Oct 31, 2025 · Assigned by S21sec

CVE-2025-64385INCORRECT SECURITY VALIDATION IN SENDING UDP FRAMES

Critical 9.2

In plain English

A critical-severity improper input validation in TCPRS1plus from Circutor. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 4.0)9.2Critical

Exploit odds (30 days)0.4%top 65.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The equipment initially can be configured using the manufacturer's application, by Wi-Fi, by the web server or with the manufacturer’s software. Using the manufacturer's software, the device can be configured via UDP. Analyzing this communication, it has been observed that any aspect of the initial configuration can be changed by means of the device's MAC without the need for authentication.

Affected products (as reported)

Vendor	Product	Versions
Circutor	TCPRS1plus	1.0.14

Weakness: CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:H

In plain English

Official description

Affected products (as reported)

References