CVE-2025-3403: Vivotek NVR ND8422P/NVR ND9525P/NVR ND9541P HTML Form sensitive information in source

Description

A vulnerability was found in Vivotek NVR ND8422P, NVR ND9525P and NVR ND9541P 2.4.0.204/3.3.0.104/4.2.0.101. It has been classified as problematic. Affected is an unknown function of the component HTML Form Handler. The manipulation leads to inclusion of sensitive information in source code. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

High

User interaction

None

Confidentiality

Low

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 32% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

NN

NVR ND8422P · Vivotek

2.4.0.204; 3.3.0.104; 4.2.0.101 · source: vendor

NN

NVR ND9525P · Vivotek

2.4.0.204; 3.3.0.104; 4.2.0.101 · source: vendor

NN

NVR ND9541P · Vivotek

2.4.0.204; 3.3.0.104; 4.2.0.101 · source: vendor