What is the CVSS score of CVE-2025-4130?

CVE-2025-4130 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of PAVO Pay are affected by CVE-2025-4130?

PAVO Inc.'s PAVO Pay payment platform (versions before 13.05.2025) contains hard-coded authentication credentials in application binaries accessible to unauthenticated remote attackers; no public…

How to fix or mitigate CVE-2025-4130?

Within 24 hours: Inventory all PAVO Pay deployments, identify installed versions, and isolate pre-13.05.2025 instances from production networks where operationally feasible; disable external API/network access. Within 7 days: Contact PAVO Inc. for patch availability and delivery timeline; assess which credentials and downstream systems may have been compromised. Within 30 days: Implement comprehensive credential rotation for all systems using PAVO Pay authentication; establish network segmentation to restrict binary file access; consider alternative payment platforms if vendor remediation timeline is unacceptable.

PAVO Pay CVE-2025-4130

HIGH

Use of Hard-coded Credentials (CWE-798)

2025-07-21 iletisim@usom.gov.tr

Authentication Bypass

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:40 vuln.today

DescriptionCVE.org

Use of Hard-coded Credentials vulnerability in PAVO Inc. PAVO Pay allows Read Sensitive Constants Within an Executable.

This issue affects PAVO Pay: before 13.05.2025.

AnalysisAI

Sensitive constant disclosure in PAVO Inc.'s PAVO Pay (versions before 13.05.2025) allows remote attackers to extract hard-coded credentials embedded in the application binary, undermining authentication controls for the payment platform. The CVSS 7.5 score reflects high confidentiality impact with no required privileges or user interaction, though EPSS at 0.27% suggests limited mass exploitation interest and no public exploit identified at time of analysis. The disclosure originated from Turkey's national CERT (USOM), indicating a coordinated vendor advisory.

Technical ContextAI

PAVO Pay is a payment processing solution from Turkish vendor PAVO Inc. The root cause is CWE-798 (Use of Hard-coded Credentials), where authentication secrets - such as API keys, encryption keys, or service credentials - are embedded directly within the executable rather than retrieved from a secure secret store or configuration vault. An attacker who obtains the binary (via mobile app distribution, installer extraction, or filesystem access) can statically analyze it with tools like strings, IDA, Ghidra, or decompilers to recover these constants. The 'Authentication Bypass' tag suggests the embedded credentials can be reused against PAVO Pay backend services to impersonate trusted clients.

Affected ProductsAI

PAVO Pay by PAVO Inc., all versions released before 13.05.2025 (13 May 2025). No CPE strings were provided in the input data, so exact product variants (mobile SDK, POS firmware, backend integration library) are not enumerated. Vendor and national CERT advisories are published at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0166 and https://www.usom.gov.tr/bildirim/tr-25-0166.

RemediationAI

Upgrade PAVO Pay to the version released on or after 13.05.2025 as referenced in the USOM advisory TR-25-0166 (https://www.usom.gov.tr/bildirim/tr-25-0166) - patch available per vendor advisory, with no granular semantic version identified in the provided data. Because hard-coded credentials remain valid until rotated, operators should also coordinate with PAVO to rotate any API keys, signing secrets, or service credentials that may have been embedded in vulnerable builds, even after upgrading. As a compensating control where immediate upgrade is not possible, restrict network egress from PAVO Pay clients to only the PAVO backend FQDNs and monitor for anomalous authentication patterns; binary obfuscation alone is not a reliable mitigation since static analysis can defeat it.