CVE-2025-47419 Non-Secure Access
Attackers can sniff network traffic to steal sensitive data like passwords due to cleartext transmission in the Web UI and API.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-47419?
CVE-2025-47419 is a critical vulnerability in Crestron Automate VX, published on 6 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Cleartext Transmission of Sensitive Information vulnerability in Crestron Automate VX allows Sniffing Network Traffic.
The device allows Web UI and API access over non-secure network ports which exposes sensitive information such as user passwords.
This issue affects Automate VX: from 5.6.8161.21536 through 6.4.0.49.
Weakness: CWE-319
Which versions are affected by CVE-2025-47419?
How do I fix CVE-2025-47419?
No fix has been published for CVE-2025-47419 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-47419 being exploited?
There is no known exploitation of CVE-2025-47419 in the wild and no public exploit code.
Sources
Also known as GHSA-49xp-c6gp-qwww.