CVE-2025-63292 Information disclosure in n/a
Attackers can passively capture unencrypted IMSI identifiers from Wi-Fi frames, enabling subscriber tracking and correlation on Freebox devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-63292?
CVE-2025-63292 is a low-severity vulnerability in n/a, published on 17 Nov 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Freebox v5 HD (firmware = 1.7.20), Freebox v5 Crystal (firmware = 1.7.20), Freebox v6 Révolution r1–r3 (firmware = 4.7.x), Freebox Mini 4K (firmware = 4.7.x), and Freebox One (firmware = 4.7.x) were discovered to expose subscribers' IMSI identifiers in plaintext during the initial phase of EAP-SIM authentication over the `FreeWifi_secure` network. During the EAP-Response/Identity exchange, the subscriber's full Network Access Identifier (NAI), which embeds the raw IMSI, is transmitted without encryption, tunneling, or pseudonymization. An attacker located within Wi-Fi range (~100 meters) can passively capture these frames without requiring user interaction or elevated privileges. The disclosed IMSI enables device tracking, subscriber correlation, and long-term monitoring of user presence near any broadcasting Freebox device. The vendor acknowledged the vulnerability, and the `FreeWifi_secure` service is planned for full deactivation by 1 October 2025.
Weakness: CWE-319
Which versions are affected by CVE-2025-63292?
It affects 5 products.
Products include Freebox Mini 4k Firmware, Freebox One Firmware, Freebox V5 Crystal Firmware, Freebox V5 Hd Firmware, Freebox V6 Revolution Firmware.
How do I fix CVE-2025-63292?
No fix has been published for CVE-2025-63292 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-63292 being exploited?
There is no known exploitation of CVE-2025-63292 in the wild and no public exploit code.
Sources
Also known as GHSA-hrfx-qmg2-hmmr.