What is the CVSS score of CVE-2025-5484?

CVE-2025-5484 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2025-5484?

Within 24 hours: Inventory all SinoTrack devices in use and identify those with internet-facing management interfaces; immediately isolate affected devices to restricted networks or disable remote management access. Within 7 days: Implement network segmentation to restrict SinoTrack management interface access to VPN or trusted IP ranges only; audit access logs for unauthorized authentication attempts. Within 30 days: Evaluate replacement with alternative vendors offering secure default credential management; develop incident response procedures specific to SinoTrack compromise; conduct security awareness training on risks of default credentials and device identifier exposure on public platforms.

CVE-2025-5484

EUVD-2025-18210 HIGH

Weak Authentication (CWE-1390)

2025-06-12 ics-cert@hq.dhs.gov

Information Disclosure

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 21:20 euvd

EUVD-2025-18210

Analysis Generated

Mar 14, 2026 - 21:20 vuln.today

CVE Published

Jun 12, 2025 - 20:15 nvd

HIGH 8.3

DescriptionCVE.org

A username and password are required to authenticate to the central SinoTrack device management interface. The username for all devices is an identifier printed on the receiver. The default password is well-known and common to all devices. Modification of the default password is not enforced during device setup. A malicious actor can retrieve device identifiers with either physical access or by capturing identifiers from pictures of the devices posted on publicly accessible websites such as eBay.