What is the CVSS score of CVE-2025-63364?

CVE-2025-63364 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2025-63364?

Yes, a public proof-of-concept exploit is available for CVE-2025-63364. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-63364?

Within 24 hours: Identify all Waveshare RS232/485 to WiFi/Ethernet (B) devices running firmware V3.1.1.0 and isolate them from untrusted networks; audit access logs for suspicious credential usage. Within 7 days: Change all administrator credentials on affected devices and implement network segmentation to restrict device management traffic. Within 30 days: Contact Waveshare for patched firmware availability; evaluate alternative vendors if patches are not forthcoming and develop a replacement timeline.

Rs232 485 To Wifi Eth B Firmware CVE-2025-63364

EUVD-2025-201247 HIGH

Cleartext Transmission of Sensitive Information (CWE-319)

2025-12-04 cve@mitre.org

Information Disclosure Rs232 485 To Wifi Eth B Firmware Waveshare

7.5

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-319 OWASP Top 10:2025 A04:2025 - Cryptographic Failures ASVS 5.0 V12 - Secure Communication Transport encryption
Impact	CVSS score of 7.5 (HIGH).

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 15, 2026

Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 was discovered to transmit Administrator credentials in plaintext.

Earlier versions of this analysis (1)

v1 Mar 15, 2026 - 16:35 CVSS 7.5

RemediationAI

Monitor vendor advisories for patches. Apply mitigations such as network segmentation, access restrictions, and monitoring.

Affected VersionsENISA

n/a n/a

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability is classified as Cleartext Transmission of Sensitive Information (CWE-319).

Know when Rs232 485 To Wifi Eth B Firmware gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

PoC Detected

Dec 16, 2025 - 20:59 vuln.today

Public exploit code

CVE Published

Dec 04, 2025 - 17:15 nvd

HIGH 7.5

Executive ViewAI

Why It Matters

Waveshare serial-to-network gateway devices in your infrastructure are transmitting administrator credentials in plaintext, exposing critical network access to unauthorized parties. Organizations using these devices for industrial control, building automation, or network infrastructure face immediate risk of unauthorized device configuration and potential lateral movement into connected systems.

Business Impact: High

Compensating Controls

Implement network segmentation to restrict management access to affected devices via dedicated secure VLANs; deploy network-based intrusion detection to monitor plaintext credential transmission; disable remote management over untrusted networks and restrict access to local/VPN only; implement MAC-based access controls and monitor for unauthorized configuration changes; consider deploying a reverse proxy or VPN gateway for all device management traffic.

Threat Intelligence Overview

EPSS Score

0.0%

Top 93% exploitable

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.