github.comexploit
https://github.com/MH521/POC/blob/main/EasyCVR-%E8%A7%86%E9%A2%91%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0getbaseconfig%E6%8E%A5%E5%8F%A3%E6%9C%AA%E6%8E%88%E6%9D%83%E8%AE%BF%E9%97%AE.md CVE-2025-1595
MEDIUMNuclei
Anhui Xufan Information Technology EasyCVR getbaseconfig information disclosure
Record summary
CVE-2025-1595 has a selected CVSS score of 6.9 (medium); EIP currently links 1 Nuclei template.
Description
A vulnerability has been found in Anhui Xufan Information Technology EasyCVR up to 2.7.0 and classified as problematic. This vulnerability affects unknown code of the file /api/v1/getbaseconfig. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Description source: CVE List
Exploitation context
Available material
- Nuclei templates
- 1
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 24, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
| CVE List | 2.0 | affected | |
| 2.1 | affected | ||
| 2.2 | affected | ||
| 2.3 | affected | ||
| 2.4 | affected | ||
| 2.5 | affected | ||
| 2.6 | affected | ||
| 2.7 | affected |
Nuclei templates
1ProjectDiscoveryMEDIUMEasyCVR <=2.1.2 - Information DisclosureCVSS 5.3
A vulnerability has been found in Anhui Xufan Information Technology EasyCVR up to 2.7.0 and classified as problematic. This vulnerability affects unknown code of the file /api/v1/getbaseconfig. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Impact
Unauthenticated attackers can retrieve sensitive configuration data including device passwords and API authentication credentials through the exposed getbaseconfig endpoint.
Remediation
Upgrade to EasyCVR version 2.7.1 or later that restricts access to the configuration endpoint.
WeaknessesCWE-200
Authorsritikchaddha
Template tagscvecve2025exposureeasycvrvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Shodan: http.title:"EasyCVR"
FOFA: title="EasyCVR"
Source: ProjectDiscovery
References
5nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-1595 VDB-296590 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions required
https://vuldb.com/?ctiid.296590 VDB-296590 | Anhui Xufan Information Technology EasyCVR getbaseconfig information disclosurevdb entry
https://vuldb.com/?id.296590 Submit #497485 | 安徽旭帆信息科技有限公司 EasyCVR-视频管理平台 未知 Use of Java I/OThird-party advisory
https://vuldb.com/?submit.497485