{"id":"CVE-2025-12636","aliases":["EUVD-2025-38194","GHSA-vfq4-w7v4-7pf6"],"status":"published","title":"Ubia Ubox","description":"The Ubia camera ecosystem fails to adequately secure API credentials, \npotentially enabling an attacker to connect to backend services. The \nattacker would then be able to gain unauthorized access to available \ncameras, enabling the viewing of live feeds or modification of settings.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00266,"percentile":0.18637,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-522"],"published":"2025-11-06T22:15:01Z","modified":"2026-10-18T21:10:00Z","products":[{"vendor":"ubia","product":"ubox android"},{"vendor":"ubia","product":"ubox ios"}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-25-310-02"},{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-310-02.json"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12636"},{"url":"https://github.com/advisories/GHSA-vfq4-w7v4-7pf6"}],"sources":{"cve":[{"id":"CVE-2025-12636","title":"Ubia Ubox","description":"The Ubia camera ecosystem fails to adequately secure API credentials, \npotentially enabling an attacker to connect to backend services. The \nattacker would then be able to gain unauthorized access to available \ncameras, enabling the viewing of live feeds or modification of settings.","status":"published","published":"2025-11-06T22:15:01.13Z","modified":"2026-01-28T16:06:41.083Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:32:42.078906Z"}],"euvd":[{"id":"EUVD-2025-38194","description":"The Ubia camera ecosystem fails to adequately secure API credentials, \npotentially enabling an attacker to connect to backend services. The \nattacker would then be able to gain unauthorized access to available \ncameras, enabling the viewing of live feeds or modification of settings.","status":"published","published":"2025-11-06T22:15:01Z","modified":"2026-01-28T16:06:41Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T19:48:46.416428Z"}],"ghsa":[{"id":"GHSA-vfq4-w7v4-7pf6","title":"The Ubia camera ecosystem fails to adequately secure API credentials, \npotentially enabling an...","description":"The Ubia camera ecosystem fails to adequately secure API credentials, \npotentially enabling an attacker to connect to backend services. The \nattacker would then be able to gain unauthorized access to available \ncameras, enabling the viewing of live feeds or modification of settings.","status":"published","published":"2025-11-07T00:30:31Z","modified":"2025-11-07T00:30:32Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T15:04:41.90926Z"}],"nvd":[{"id":"CVE-2025-12636","description":"The Ubia camera ecosystem fails to adequately secure API credentials, \npotentially enabling an attacker to connect to backend services. The \nattacker would then be able to gain unauthorized access to available \ncameras, enabling the viewing of live feeds or modification of settings.","status":"published","published":"2025-11-06T23:15:35.693Z","modified":"2026-10-18T21:10:00.12Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:11:42.870953Z"}]}}