CVE-2025-63207

Critical · 9.8

CVSS

9.8

EPSS

7.4%

Published

Nov 19, 2025

CISA due date

—

The record

The R.V.R Elettronica TEX product (firmware TEXL-000400, Web GUI TLAN-000400) is vulnerable to broken access control due to improper authentication checks on the /_Passwd.html endpoint. An attacker can send an unauthenticated POST request to change the Admin, Operator, and User passwords, resulting in complete system compromise.

Affected packages

Ecosystem	Package	Introduced	Fixed