CVE-2025-4384

Published May 6, 2025

Last updated 2 months ago

CVSS medium 6.0

Overview

Description
The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet become valid. This allows malicious devices to present certificates that are not rejected properly. The use of a client certificate reduces the risk for random devices to take advantage of this flaw.
Source
87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932
NVD status
Awaiting Analysis

Risk scores

CVSS 4.0

Type
Secondary
Base score
6
Impact score
-
Exploitability score
-
Vector string
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:M/U:Green
Severity
MEDIUM

Weaknesses

87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932
CWE-298

Social media

Hype score
Not currently trending

  1. CVE-2025-4384 The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet become valid. This allows malicious devices to presen… https://t.co/ngpASk25gr

    @CVEnew

    6 May 2025

    331 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

References

Sources include official advisories and independent security research.