CVE-2025-12790

A flaw was found in Rubygem MQTT. By default, the package used to not have hostname validation, resulting in possible Man-in-the-Middle (MITM) attack.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2025-12790
https://bugzilla.redhat.com/show_bug.cgi?id=2413004
https://github.com/njh/ruby-mqtt/blob/main/NEWS.md#ruby-mqtt-version-070-2025-10-29

Configurations

No configuration.

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Se encontró una vulnerabilidad en Rubygem MQTT. Por defecto, el paquete no solía tener validación de nombre de host, lo que resultaba en un posible ataque man-in-the-middle (MitM).

Information

Published : 2025-11-06 21:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-12790

Mitre link : CVE-2025-12790

CVE.ORG link : CVE-2025-12790

JSON object : View

Products Affected

No product.

CWE

CWE-29

Path Traversal: '\..\filename'

{"id": "CVE-2025-12790", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12790", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-08T04:55:20.280647Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"vendor": "Nicholas J Humfrey", "product": "ruby-mqtt", "versions": [{"status": "affected", "version": "0", "lessThan": "0.7.0", "versionType": "semver"}], "packageName": "ruby-mqtt", "collectionURL": "https://github.com/njh/ruby-mqtt", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:satellite:6"], "vendor": "Red Hat", "product": "Red Hat Satellite 6", "packageName": "rubygem-mqtt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:satellite:6"], "vendor": "Red Hat", "product": "Red Hat Satellite 6", "packageName": "satellite:el8/rubygem-mqtt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2025-11-06T21:15:40.000", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-12790", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2413004", "source": "secalert@redhat.com"}, {"url": "https://github.com/njh/ruby-mqtt/blob/main/NEWS.md#ruby-mqtt-version-070-2025-10-29", "source": "secalert@redhat.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-29"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Rubygem MQTT. By default, the package used to not have hostname validation, resulting in possible Man-in-the-Middle (MITM) attack."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad en Rubygem MQTT. Por defecto, el paquete no sol\u00eda tener validaci\u00f3n de nombre de host, lo que resultaba en un posible ataque man-in-the-middle (MitM)."}], "lastModified": "2026-10-18T21:10:00.120", "sourceIdentifier": "secalert@redhat.com"}