Incorrect access control on Dataphone A920 v2025.07.161103 exposes a service on port 8888 by default on the local network without authentication. This allows an attacker to interact with the device via a TCP socket without credentials. Additionally, sending an HTTP request to the service on port 8888 triggers an error in the response, which exposes the functionality, headers identifying Paytef dataphone packets, and the build version.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
| Link | Providers |
|---|---|
| https://github.com/stuxve/expose-service-8888-dataphone |
|
History
Wed, 29 Oct 2025 17:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Incorrect access control on Dataphone A920 v2025.07.161103 exposes a service on port 8888 by default on the local network without authentication. This allows an attacker to interact with the device via a TCP socket without credentials. Additionally, sending an HTTP request to the service on port 8888 triggers an error in the response, which exposes the functionality, headers identifying Paytef dataphone packets, and the build version. | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2025-10-29T16:56:47.688Z
Reserved: 2025-09-26T00:00:00.000Z
Link: CVE-2025-61234
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-10-29T17:15:36.330
Modified: 2025-10-29T17:15:36.330
Link: CVE-2025-61234
Redhat
No data.
OpenCVE Enrichment
No data.