MicroServer CVE-2025-64305

Requires physical access to the unencrypted external SD card that the MicroServer writes at boot; the card holds plaintext copies of firmware parts containing user and vendor secrets. Exploitation is gated by that physical/media access - there is no evidence of remote retrieval of the SD contents. Once secrets are obtained, the attacker can authenticate to the web portal as admin or build modified vendor firmware, so the follow-on impact spans confidentiality and integrity. Limiting factors: physical proximity to the device and its SD slot, a niche OT weather-station deployment, and no user interaction or prior authentication otherwise needed.

This is a genuinely low-priority issue despite a moderate 7.1 CVSS 4.0 score. The core weakness (CWE-313, cleartext storage) exposes user and vendor secrets, but every signal points to limited real-world risk: EPSS is 0.01% (1st percentile), there is no CISA KEV listing (no confirmed active exploitation), and no public POC. The single strongest limiting factor is the access path - secrets reside on an EXTERNAL SD card that must be physically read. The vendor's CVSS 4.0 vector claims AV:A (adjacent/network-adjacent), which is inconsistent with a description centered on reading an unencrypted physical SD card; that vector should be verified with the vendor, as physical media access (AV:P) is the more defensible reading. The vendor also scored VC:H with VI:N/VA:N, yet the description explicitly states the stolen secrets let an attacker 'modify the vendor firmware, or gain admin access to the web portal' - that is a clear integrity impact the vendor vector omits. Net: high-confidence low priority because of the physical-access precondition and niche deployment, but the impact ceiling (firmware tampering + admin takeover) is higher than the 'Information Disclosure' tag suggests.

An attacker with physical access to a deployed Columbia Weather MicroServer removes or reads its unencrypted external SD card, onto which the device copied firmware containing plaintext user and vendor secrets at boot. Using those credentials, the attacker logs into the web portal as an administrator or crafts modified vendor firmware for the device. No public exploit code has been identified at time of analysis.