CVE-2025-63208 Details
Description
An issue was discovered in bridgetech VB288 Objective QoE Content Extractor, firmware version 5.6.0-8, allowing attackers to gain sensitive information such as administrator passwords via the /probe/core/setup/passwd endpoint.
A vulnerability allowing unauthorized access to sensitive information, such as administrator passwords, has been identified in the Bridge Technologies VB288 Objective QoE Content Extractor, specifically in firmware version 5.6.0-8. The issue arises from improper authorization in the '/probe/core/setup/passwd' endpoint, allowing attackers to extract password data through simple HTTP requests.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Nov 20, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://bridgetech.tv/ | [email protected] | Product |
| https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63208_bridgetech%20VB288%20Information%20Disclosure | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-312 | Cleartext Storage of Sensitive Information | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| bridgetech vb288 firmware | 5.6.0-8 |
CPE
Remediation
| |
| bridgetech vb288 | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 15, 2026 | Initial Analysis | [email protected] |
| Nov 20, 2025 | CVE Modified | CISA-ADP |
| Nov 19, 2025 | New CVE Received | [email protected] |