CVE-2025-63205 Information disclosure in n/a
Attackers can retrieve administrator passwords via an exposed endpoint, compromising network probe devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-63205?
CVE-2025-63205 is a high-severity vulnerability in n/a, published on 19 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in bridgetech probes VB220 IP Network Probe,VB120 Embedded IP + RF Probe, VB330 High-Capacity Probe, VB440 ST 2110 Production Analytics Probe, and NOMAD, firmware versions 6.5.0-9, allowing attackers to gain sensitive information such as administrator passwords via the /probe/core/setup/passwd endpoint. NOTE: the Supplier disagrees that 6.5.0-9 is affected, and instead reports that 5.6.0-3 and earlier are affected, and 5.6.0-4 (2020-09-21) and later are fixed.
Weakness: CWE-200
Which versions are affected by CVE-2025-63205?
It affects 5 products.
Products include Bridgetech Nomad Portable Firmware, Bridgetech Vb120 Firmware, Bridgetech Vb220 Firmware, Bridgetech Vb330 Firmware, Bridgetech Vb440 Firmware.
How do I fix CVE-2025-63205?
No fix has been published for CVE-2025-63205 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-63205 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-63205 exists.
Sources
Also known as GHSA-2f4p-w49c-4q77.