CVE-2025-7214

A vulnerability classified as problematic was found in FNKvision FNK-GU2 up to 40.1.7. Affected by this vulnerability is an unknown functionality of the file /etc/shadow of the component MD5. The manipulation leads to risky cryptographic algorithm. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.

CVSS v3 1.6 LOW
CVSS v2.0 0.8 LOW

1.6^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.2 / Impact : 1.4

Attack Vector PHYSICAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

0.8^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:H/Au:M/C:P/I:N/A:N

Exploitability : 1.2 / Impact : 2.9

Access Vector LOCAL

Access Complexity HIGH

Authentication MULTIPLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://medium.com/@pundhapat/sqli-in-the-cloud-root-on-the-board-a-beginners-journey-into-iot-hacking-06efb2539a21
https://vuldb.com/?ctiid.315163
https://vuldb.com/?id.315163
https://vuldb.com/?submit.608027

Configurations

No configuration.

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad clasificada como problemática fue encontrada en FNKvision FNK-GU2 hasta 40.1.7. Afectada por esta vulnerabilidad es una funcionalidad desconocida del archivo /etc/sha4dow del componente MD5. La manipulación conduce a un algoritmo criptográfico riesgoso. Es posible lanzar el ataque en el dispositivo físico. La complejidad de un ataque es bastante alta. La explotación parece ser difícil. El exploit ha sido divulgado al público y puede ser usado.

Information

Published : 2025-07-09 04:16

Updated : 2026-10-18 21:10

NVD link : CVE-2025-7214

Mitre link : CVE-2025-7214

CVE.ORG link : CVE-2025-7214

JSON object : View

Products Affected

No product.

CWE

CWE-310

Cryptographic Issues

CWE-327

Use of a Broken or Risky Cryptographic Algorithm

{"id": "CVE-2025-7214", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-7214", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-09T14:28:03.560920Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 0.8, "accessVector": "LOCAL", "vectorString": "AV:L/AC:H/Au:M/C:P/I:N/A:N", "authentication": "MULTIPLE", "integrityImpact": "NONE", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 1.2, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 1.6, "attackVector": "PHYSICAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 0.2}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 0.3, "Automatable": "NOT_DEFINED", "attackVector": "PHYSICAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:H/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"vendor": "FNKvision", "modules": ["MD5"], "product": "FNK-GU2", "versions": [{"status": "affected", "version": "40.1.0"}, {"status": "affected", "version": "40.1.1"}, {"status": "affected", "version": "40.1.2"}, {"status": "affected", "version": "40.1.3"}, {"status": "affected", "version": "40.1.4"}, {"status": "affected", "version": "40.1.5"}, {"status": "affected", "version": "40.1.6"}, {"status": "affected", "version": "40.1.7"}]}]}], "published": "2025-07-09T04:16:10.370", "references": [{"url": "https://medium.com/@pundhapat/sqli-in-the-cloud-root-on-the-board-a-beginners-journey-into-iot-hacking-06efb2539a21", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?ctiid.315163", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?id.315163", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?submit.608027", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-310"}, {"lang": "en", "value": "CWE-327"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability classified as problematic was found in FNKvision FNK-GU2 up to 40.1.7. Affected by this vulnerability is an unknown functionality of the file /etc/shadow of the component MD5. The manipulation leads to risky cryptographic algorithm. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used."}, {"lang": "es", "value": "Una vulnerabilidad clasificada como problem\u00e1tica fue encontrada en FNKvision FNK-GU2 hasta 40.1.7. Afectada por esta vulnerabilidad es una funcionalidad desconocida del archivo /etc/sha4dow del componente MD5. La manipulaci\u00f3n conduce a un algoritmo criptogr\u00e1fico riesgoso. Es posible lanzar el ataque en el dispositivo f\u00edsico. La complejidad de un ataque es bastante alta. La explotaci\u00f3n parece ser dif\u00edcil. El exploit ha sido divulgado al p\u00fablico y puede ser usado."}], "lastModified": "2026-10-18T21:10:00.120", "sourceIdentifier": "cna@vuldb.com"}