CVE-2025-0631

CVE Enrichment

CVSS: 8.7 HIGH
EPSS: 0.28%
EPSS Percentile: 18.72%
CISA KEV: Not listed

Description

A Credential Exposure Vulnerability exists in the above-mentioned product and version. The vulnerability is due to using HTTP resulting in credentials being sent in clear text.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 29-Jan-2025 02:15
Last Modified: 17-Jun-2026 15:26
EPSS Date: 2026-10-20
CWE: CWE-319

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:N /
                            UI:N /
                            VC:H /
                            VI:N /
                            VA:N /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

References

[email protected]

Last enrichment sync: 21-Oct-2026 16:40
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

| **CVE-2025-0631** | 8.7 | CWE-319: Cleartext Transmission of Sensitive Information | Rockwell Automation PowerFlex 755 | Nozomi H2 2025 Report Highlights Credential Exposure and OT/IoT Security Gaps

CVE (7)

Malware (10)

Threat Actors (8)

MITRE ATT&CK (12)

Vendors (6)

Products (10)

Tools (2)

Industries (3)

Countries (17)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.