{"id":"CVE-2025-0479","aliases":["EUVD-2025-1702","GHSA-wwpc-74vx-c2x3"],"status":"published","title":"Security Misconfiguration Vulnerability in CP Plus Router","description":"This vulnerability exists in the CP Plus Router due to insecure handling of cookie flags used within its web interface. A remote attacker could exploit this vulnerability by intercepting data transmissions during an HTTP session on the vulnerable system.\n \nSuccessful exploitation of this vulnerability could allow the attacker to obtain sensitive information and compromise the targeted system.","severity":{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00457,"percentile":0.39941,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1004","CWE-614"],"published":"2025-01-20T11:37:13Z","modified":"2026-06-17T08:26:33Z","products":[{"vendor":"cp plus","product":"cp-xr-de21-s router"}],"references":[{"url":"https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2025-0005","tags":["third-party-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0479"},{"url":"https://github.com/advisories/GHSA-wwpc-74vx-c2x3"}],"sources":{"cve":[{"id":"CVE-2025-0479","title":"Security Misconfiguration Vulnerability in CP Plus Router","description":"This vulnerability exists in the CP Plus Router due to insecure handling of cookie flags used within its web interface. A remote attacker could exploit this vulnerability by intercepting data transmissions during an HTTP session on the vulnerable system.\n \nSuccessful exploitation of this vulnerability could allow the attacker to obtain sensitive information and compromise the targeted system.","status":"published","published":"2025-01-20T11:37:13.747Z","modified":"2025-01-21T20:10:36.388Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-1004","CWE-614"],"updated_at":"2026-11-02T14:32:53.81273Z"}],"euvd":[{"id":"EUVD-2025-1702","description":"This vulnerability exists in the CP Plus Router due to insecure handling of cookie flags used within its web interface. A remote attacker could exploit this vulnerability by intercepting data transmissions during an HTTP session on the vulnerable system.\n \nSuccessful exploitation of this vulnerability could allow the attacker to obtain sensitive information and compromise the targeted system.","status":"published","published":"2025-01-20T11:37:13Z","modified":"2025-01-21T20:10:36Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-03T00:04:15.779798Z"}],"ghsa":[{"id":"GHSA-wwpc-74vx-c2x3","title":"This vulnerability exists in the CP Plus Router due to insecure handling of cookie flags used...","description":"This vulnerability exists in the CP Plus Router due to insecure handling of cookie flags used within its web interface. A remote attacker could exploit this vulnerability by intercepting data transmissions during an HTTP session on the vulnerable system.\n \nSuccessful exploitation of this vulnerability could allow the attacker to obtain sensitive information and compromise the targeted system.","status":"published","published":"2025-01-20T12:30:51Z","modified":"2025-01-20T12:30:52Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-614"],"updated_at":"2026-11-02T14:59:36.307613Z"}],"nvd":[{"id":"CVE-2025-0479","description":"This vulnerability exists in the CP Plus Router due to insecure handling of cookie flags used within its web interface. A remote attacker could exploit this vulnerability by intercepting data transmissions during an HTTP session on the vulnerable system.\n \nSuccessful exploitation of this vulnerability could allow the attacker to obtain sensitive information and compromise the targeted system.","status":"published","published":"2025-01-20T12:15:23.563Z","modified":"2026-06-17T08:26:33.907Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-614","CWE-1004"],"updated_at":"2026-11-02T14:10:49.483601Z"}]}}