PowerG CVE-2025-61738

Exploitation requires the attacker to be within radio range of the target's PowerG wireless security network and to observe traffic during the specific window in which the network key can be captured ('under certain circumstances' per the description - the exact trigger, likely device pairing/enrollment or a particular session state, is not detailed in the available data). Limiting factors are significant: the CVSS vector sets AC:H (the circumstances are not generally present), UI:P (a passive user/operator action is needed), and the attack is bounded to the PowerG RF medium rather than arbitrary internet reachability. Authentication is unauthenticated (PR:N in the provided vector), but RF proximity and the conditional trigger substantially constrain realistic exploitation.

This is a genuinely low-priority issue by every available signal, not a high-CVSS flaw that merely sounds scary. The vendor-assigned CVSS 4.0 base score is only 2.3 (Low), driven by AC:H (high attack complexity - exploitation works only 'under certain circumstances'), UI:P (passive user interaction required), and VC:L with no integrity or availability impact in the official vector. EPSS agrees: 0.18% probability at the 7th percentile indicates near-negligible expectation of exploitation. The CVE is NOT on CISA KEV and no public exploit code is referenced, so exploitation status is 'no public exploit identified at time of analysis.' One cross-source tension worth flagging: the official vector is scored AV:N, but PowerG is an RF/wireless security-panel protocol and the described attack (capturing the network key off the medium) is realistically a radio-proximity attack closer to AV:A - the network labeling likely overstates remote reachability, so real-world risk is lower than AV:N implies. A second tension: the CWE-319 classification and the phrase 'read or write encrypted packets' imply a potential integrity impact (packet injection/spoofing), yet the vendor vector sets VI:N - so the official score may slightly understate impact even as its attack-vector choice overstates reach.

An attacker within radio range of a PowerG wireless security network passively observes traffic and, under specific timing/configuration circumstances, recovers the network key. With the key the attacker can decrypt sensor/panel traffic and potentially inject or forge 'encrypted' packets to read protected data or tamper with communications. No public proof-of-concept exists, and the high attack complexity plus required proximity/interaction make opportunistic exploitation unlikely.