CVE-2025-6625

CVE Enrichment

CVSS: 8.7 HIGH
EPSS: 0.50%
EPSS Percentile: 41.56%
CISA KEV: Not listed

Description

CWE-20: Improper Input Validation vulnerability exists that could cause a Denial Of Service when specific crafted FTP command is sent to the device.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 18-Aug-2025 14:15
Last Modified: 17-Jun-2026 17:02
EPSS Date: 2026-10-20
CWE: CWE-20

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:N /
                            UI:N /
                            VC:N /
                            VI:H /
                            VA:N /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

References

[email protected]

Last enrichment sync: 21-Oct-2026 16:37
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

| **CVE-2025-6625** | 8.7 | CWE-20: Improper Input Validation | Schneider Electric Modicon M340 and Communication Modules | Nozomi H2 2025 Report Highlights Credential Exposure and OT/IoT Security Gaps

CVE (7)

Malware (10)

Threat Actors (8)

MITRE ATT&CK (12)

Vendors (6)

Products (10)

Tools (2)

Industries (3)

Countries (17)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.