What is the CVSS score of CVE-2025-34081?

CVE-2025-34081 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2025-34081?

Within 24 hours: Identify all CONPROSYS HMI System (CHS) installations in your environment and document current versions. Within 7 days: Apply vendor-released patch to upgrade all CHS deployments to version 3.7.7 or later. Within 30 days: Conduct a post-patch verification scan to confirm the phpinfo() debug page is no longer accessible and implement network-level access controls restricting debug interfaces to authorized personnel only.

Conprosys Hmi System CVE-2025-34081

Q: Which versions of Conprosys Hmi System are affected by CVE-2025-34081?

Contec's CONPROSYS HMI System (CHS) exposes a publicly accessible PHP debug page that reveals sensitive system configuration details to unauthenticated users, enabling attackers to gather…. A patch is available.

EUVD-2025-19656 HIGH

Insertion of Sensitive Information Into Debugging Code (CWE-215)

2025-07-01 disclosure@vulncheck.com

PHP Information Disclosure Conprosys Hmi System Contec

7.5

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-215 OWASP Top 10:2025 A10:2025 - Mishandling of Exceptional Conditions ASVS 5.0 V16 - Security Logging and Error Handling Debug information protection
Impact	Exposed information (credentials, internal paths, user data, configuration) can be leveraged for further attacks or regulatory violations. With a CVSS score of 7.5 (HIGH), this represents a significant risk.
Exploit ScenarioDerived	An attacker triggers error conditions or accesses improperly protected endpoints to extract sensitive internal information from the application.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 16, 2026

The Contec Co.,Ltd. CONPROSYS HMI System (CHS) exposes a PHP phpinfo() debug page to unauthenticated users that may contain sensitive data useful for an attacker.This issue affects CONPROSYS HMI System (CHS): before 3.7.7.

Earlier versions of this analysis (1)

v1 Mar 16, 2026 - 01:42 CVSS 7.5

RemediationAI

Implement proper access controls. Sanitize error messages in production. Review logging practices to avoid capturing sensitive data.

Affected VersionsENISA

CONPROSYS HMI System (CHS) 0 <3.7.7

Affected Packages

euvd conprosys_hmi_system_chs fix: 3.7.7

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Information disclosure occurs when an application inadvertently reveals sensitive data to unauthorized actors through error messages, logs, or improper access controls.

Know when Conprosys Hmi System gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

3.7.7

CVE Published

Jul 01, 2025 - 18:15 nvd

HIGH 7.5

Executive ViewAI

Why It Matters

Contec's CONPROSYS HMI System (CHS) exposes a publicly accessible PHP debug page that reveals sensitive system configuration details to unauthenticated users, enabling attackers to gather reconnaissance information for follow-on attacks. Organizations running CHS versions prior to 3.7.7 should treat this as an information disclosure risk that weakens overall security posture by providing attackers with detailed system architecture and software inventory data.

Business Impact: Medium

Compensating Controls

Apply vendor patch to upgrade to CHS version 3.7.7 or later. If immediate patching is not feasible, implement firewall rules to restrict HTTP/HTTPS access to the CHS interface to trusted administrative networks only, and disable or remove the phpinfo() debug page through CHS configuration if the application permits manual remediation.

Threat Intelligence Overview

EPSS Score

0.1%

Top 75% exploitable

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.