Vulnerability · Published Jan 30, 2025 · Assigned by icscert
CVE-2025-0681New Rock Technologies Cloud Connected Devices Improper Neutralization of Wildcards or Matching Symbols
Medium 6.2
In plain English
A medium-severity security flaw in MX8G VoIP Gateway from New Rock Technologies. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).
Severity (CVSS 3.1)6.2Medium
Exploit odds (30 days)0.2%top 92.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Cloud MQTT service of the affected products supports wildcard topic subscription which could allow an attacker to obtain sensitive information from tapping the service communications.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| New Rock Technologies | OM500 IP-PBX | All |
| New Rock Technologies | MX8G VoIP Gateway | All |
| New Rock Technologies | NRP1302/P Desktop IP Phone | All |
Weakness: CWE-155 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N