CVE-2025-55443 Information disclosure in n/a
Attackers with log access can steal plaintext admin credentials and MQTT details to control devices and intercept data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-55443?
CVE-2025-55443 is a critical vulnerability in n/a, published on 26 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Telpo MDM 1.4.6 thru 1.4.9 for Android contains sensitive administrator credentials and MQTT server connection details (IP/port) that are stored in plaintext within log files on the device's external storage. This allows attackers with access to these logs to: 1. Authenticate to the MDM web platform to execute administrative operations (device shutdown/factory reset/software installation); 2. Connect to the MQTT server to intercept/publish device data.
Weakness: CWE-312
Which versions are affected by CVE-2025-55443?
It affects 1 product.
Products include Telpo Telpo Mdm.
How do I fix CVE-2025-55443?
No fix has been published for CVE-2025-55443 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-55443 being exploited?
There is no known exploitation of CVE-2025-55443 in the wild and no public exploit code.
Sources
Also known as GHSA-6pcj-93vx-9466.