nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-0681 CVE-2025-0681
MEDIUM
New Rock Technologies Cloud Connected Devices Improper Neutralization of Wildcards or Matching Symbols
Record summary
CVE-2025-0681 has a selected CVSS score of 6.9 (medium).
Description
The Cloud MQTT service of the affected products supports wildcard topic subscription which could allow an attacker to obtain sensitive information from tapping the service communications.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 30, 2025 · Source: CVE List
Affected products and versions
3| Product | Source | Version range | Status |
|---|---|---|---|
MX8G VoIP GatewayBrowse New Rock Technologies / MX8G VoIP GatewayDefault status: unaffected | CVE List | All versions | affected |
NRP1302/P Desktop IP PhoneBrowse New Rock Technologies / NRP1302/P Desktop IP PhoneDefault status: unaffected | CVE List | All versions | affected |
OM500 IP-PBXBrowse New Rock Technologies / OM500 IP-PBXDefault status: unaffected | CVE List | All versions | affected |
References
3cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-25-030-02 newrocktech.com
https://www.newrocktech.com/ContactUs/index.html