Brute Force CVE-2025-5485

CVSS 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) indicates a highly accessible vulnerability requiring no authentication, low complexity, and high confidentiality impact. However, real-world risk depends on several factors: (1) Active exploitation status and KEV listing would significantly elevate priority; (2) Existence of proof-of-concept code indicates operational threat; (3) EPSS score, if available, would quantify exploitation probability relative to other CVEs; (4) The vulnerability is pre-authentication and network-accessible, meeting SSVC criteria for 'exploitable' with high likelihood; (5) Technical impact includes information disclosure (valid device enumeration) which could support lateral reconnaissance. The confidentiality impact (C:H) is the primary concern—attackers can discover valid devices for follow-on attacks. The limited integrity/availability impact (I:L/A:L) suggests this is primarily a reconnaissance vector. Organizations managing networked devices should prioritize patching, but exploit complexity is LOW, making this a credible threat if devices are internet-exposed.

An attacker conducting reconnaissance on internet-exposed devices performs the following attack: (1) Identifies target organization's IP ranges hosting web-managed devices; (2) Initiates unauthenticated HTTP/HTTPS requests to management interface login endpoints with username payloads: '0000000000', '0000000001', '0000000002'... (3) Observes response differences—valid usernames may return 'invalid password' while invalid usernames return 'user not found' or differ in response timing; (4) Efficiently enumerates valid device identifiers across the organization's network; (5) Uses discovered device identifiers for targeted attacks: password guessing, phishing with accurate device numbers, social engineering IT staff ('Your device 5834729102 has a critical issue...'), or reconnaissance before physical attacks. If automation is available, enumeration of 1 billion device IDs is computationally achievable in hours/days depending on rate limits. No authentication required; AV:N and AC:L mean this occurs purely through network reconnaissance.