What is the CVSS score of CVE-2025-13399?

CVE-2025-13399 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Vx800v Firmware are affected by CVE-2025-13399?

CVE-2025-13399 is a HIGH severity vulnerability affecting Vx800V firmware with no available patch, creating significant risk to the confidentiality, integrity, and availability of data transmitted…

How to fix or mitigate CVE-2025-13399?

Within 24 hours: Inventory all Vx800V devices in production and assess their exposure; establish incident response readiness. Within 7 days: Implement network segmentation to isolate affected devices, disable non-essential features if possible, and establish enhanced monitoring for suspicious activity. Within 30 days: Work with the vendor for patch availability; evaluate replacement equipment or alternative solutions if no patch timeline is provided.

Vx800v Firmware CVE-2025-13399

HIGH

Insufficient Entropy (CWE-331)

2026-01-29 f23511db-6c3e-4e32-a477-6aa17d310630

Information Disclosure Vx800v Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

CVE Published

Jan 29, 2026 - 19:16 nvd

HIGH 8.8

DescriptionCVE.org

A weakness in the web interface’s application layer encryption in VX800v v1.0 allows an adjacent attacker to brute force the weak AES key and decrypt intercepted traffic. Successful exploitation requires network proximity but no authentication, and may result in high impact to confidentiality, integrity, and availability of transmitted data.

AnalysisAI

Vx800V Firmware contains a vulnerability that allows attackers to high impact to confidentiality, integrity, and availability of transmitted data (CVSS 8.8).

Technical ContextAI

exists in the web component. A weakness in the web interface’s application layer encryption in VX800v v1.0 allows an adjacent attacker to brute force the weak AES key and decrypt intercepted traffic. Successful exploitation requires network proximity but no authentication, and may result in high impact to confidentiality, integrity, and availability of transmitted data.