CVE-2025-64309
High · 7.4CVSS
7.4
EPSS
0.2%
Published
Nov 15, 2025
CISA due date
—
The record
The affected product discloses device telemetry, configuration, and sensitive information via WebSocket traffic to unauthenticated users when they connect to a specific URL. The unauthenticated URL can be discovered through basic network scanning techniques.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-54784 CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET… CWE-523
- CVE-2026-8668 A static credential embedded in Chef 360 prior to v1.7.0 permitted unauthenticated access… CWE-523
- CVE-2026-36610 Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 transmits DDNS credentials over… CWE-523
- CVE-2026-8673 Unprotected transport of credentials vulnerability in syslink software AG Avantra on… CWE-523
- CVE-2026-23635 Kiteworks is a private data network (PDN). CWE-523
- GHSA-vrjc-q2fh-6x9h Spinnaker vulnerable to SSRF due to improper restrictions on http from user input CWE-523
- CVE-2025-61916 Spinnaker is an open source, multi-cloud continuous delivery platform. CWE-523
- CVE-2025-66029 Open OnDemand provides remote web access to supercomputers. CWE-523