CVE-2025-63729 Information disclosure in n/a
Attackers can extract SSL private keys and certificates from the firmware of Syrotech GPON devices, compromising secure communications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-63729?
CVE-2025-63729 is a critical vulnerability in n/a, published on 25 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in Syrotech SY-GPON-1110-WDONT SYRO_3.7L_3.1.02-240517 allowing attackers to exctract the SSL Private Key, CA Certificate, SSL Certificate, and Client Certificates in .pem format in firmware in etc folder.
Which versions are affected by CVE-2025-63729?
It affects 1 product.
Products include Syrotech Sy-Gpon-1110-Wdont Firmware.
How do I fix CVE-2025-63729?
No fix has been published for CVE-2025-63729 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-63729 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-63729 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
- CVE-2024-41687 Cleartext Transmission of Sensitive Information Vulnerability
- CVE-2024-41686 Password Policy Bypass Vulnerability
- CVE-2024-41688 Cleartext Storage of Sensitive Information Vulnerability
- CVE-2024-41690 Default Credential Storage in Plaintext Vulnerability
- CVE-2024-41691 Insecure Storage of Sensitive Information Vulnerability
Sources
Also known as GHSA-qr4p-6qp4-5mch.