{"id":"CVE-2025-43928","aliases":["EUVD-2025-14661","GHSA-764p-g9xx-6qm8"],"status":"published","title":"In Infodraw Media Relay Service (MRS) 7.1.0.0, the MRS web server (on port 12654) allows reading...","description":"In Infodraw Media Relay Service (MRS) 7.1.0.0, the MRS web server (on port 12654) allows reading arbitrary files via ../ directory traversal in the username field. Reading ServerParameters.xml may reveal administrator credentials in cleartext or with MD5 hashing.","severity":{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0092,"percentile":0.606,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22","CWE-24"],"published":"2025-04-20T00:00:00Z","modified":"2026-06-17T09:24:45Z","products":[{"vendor":"infodraw","product":"media relay service"},{"vendor":"infodraw","product":"pmrs-102_firmware"}],"references":[{"url":"https://mint-secure.de/path-traversal-vulnerability-in-surveillance-software/","tags":["Exploit","Third Party Advisory"]},{"url":"https://cfp.eh22.easterhegg.eu/eh22/talk/9UDXSE/","tags":["Not Applicable"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43928"},{"url":"https://cfp.eh22.easterhegg.eu/eh22/talk/9UDXSE"},{"url":"https://mint-secure.de/path-traversal-vulnerability-in-surveillance-software"},{"url":"https://github.com/advisories/GHSA-764p-g9xx-6qm8"}],"sources":{"cve":[{"id":"CVE-2025-43928","description":"In Infodraw Media Relay Service (MRS) 7.1.0.0, the MRS web server (on port 12654) allows reading arbitrary files via ../ directory traversal in the username field. Reading ServerParameters.xml may reveal administrator credentials in cleartext or with MD5 hashing.","status":"published","published":"2025-04-20T00:00:00Z","modified":"2025-04-21T14:33:02.315Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-24"],"updated_at":"2026-11-02T14:32:26.64278Z"}],"euvd":[{"id":"EUVD-2025-14661","description":"In Infodraw Media Relay Service (MRS) 7.1.0.0, the MRS web server (on port 12654) allows reading arbitrary files via ../ directory traversal in the username field. Reading ServerParameters.xml may reveal administrator credentials in cleartext or with MD5 hashing.","status":"published","published":"2025-04-20T00:00:00Z","modified":"2025-04-21T14:33:02Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:18.663123Z"}],"ghsa":[{"id":"GHSA-764p-g9xx-6qm8","title":"In Infodraw Media Relay Service (MRS) 7.1.0.0, the MRS web server (on port 12654) allows reading...","description":"In Infodraw Media Relay Service (MRS) 7.1.0.0, the MRS web server (on port 12654) allows reading arbitrary files via ../ directory traversal in the username field. Reading ServerParameters.xml may reveal administrator credentials in cleartext or with MD5 hashing.","status":"published","published":"2025-04-20T03:50:41Z","modified":"2025-04-24T18:32:12Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22","CWE-24"],"updated_at":"2026-11-02T15:02:01.717603Z"}],"nvd":[{"id":"CVE-2025-43928","description":"In Infodraw Media Relay Service (MRS) 7.1.0.0, the MRS web server (on port 12654) allows reading arbitrary files via ../ directory traversal in the username field. Reading ServerParameters.xml may reveal administrator credentials in cleartext or with MD5 hashing.","status":"published","published":"2025-04-20T03:15:35.003Z","modified":"2026-06-17T09:24:45.72Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-24","CWE-22"],"updated_at":"2026-11-02T14:11:01.507281Z"}]}}