CVE-2025-47419 | Cleartext Transmission of Sensitive Information vulnerabilit… | CVSS 10.0 CRITICAL

Description

Cleartext Transmission of Sensitive Information vulnerability in Crestron Automate VX allows Sniffing Network Traffic. The device allows Web UI and API access over non-secure network ports which exposes sensitive information such as user passwords. This issue affects Automate VX: from 5.6.8161.21536 through 6.4.0.49.

Metadata

CVE ID: CVE-2025-47419
State: PUBLISHED
Assigner: Crestron
Reserved: 2025-05-06 19:36 UTC
Published: 2025-05-06 20:52 UTC
Last updated: 2025-05-07 14:03 UTC
Primary CWE: CWE-319
CWE-319 Cleartext Transmission of Sensitive Information
Vendor / Product: Crestron / Automate VX
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Crestron	Automate VX	—	5.6.8161.21536 ≤ 6.4.0.49

Weakness (CWE)

CWE	Source	Description
CWE-319	cna	CWE-319 Cleartext Transmission of Sensitive Information

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References (3)