CVE-2025-1882

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-1882

5.0 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 3.4

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

4.3 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:A/AC:H/Au:N/C:P/I:P/A:P

Exploitability : 3.2 / Impact : 6.4

Access Vector ADJACENT_NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

A

vulnerability was found in i-Drive i11 and i12 up to 20250227. It has been rated as critical. Affected by this issue is some unknown functionality of the component Device Setting Handler. The manipulation leads to improper access control for register interface. The attack needs to be done within the local network. The complexity of an attack is rather high. The exploitation is known to be difficult. It was not possible to identify the current maintainer of the product. It must be assumed that the product is end-of-life.

References
Link Resource
https://github.com/geo-chen/i-Drive Third Party Advisory
https://vuldb.com/?ctiid.298196 Permissions Required
https://vuldb.com/?id.298196 Permissions Required
https://vuldb.com/?submit.510955 Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:i-drive:i11_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:i-drive:i11:*:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:i-drive:i12_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:i-drive:i12:*:*:*:*:*:*:*:*
History

05 Mar 2025, 15:18

Type Values Removed Values Added
CWE NVD-CWE-Other
First Time I-drive
I-drive i11
I-drive i12 Firmware
I-drive i11 Firmware
I-drive i12
Summary
  • (es) Se ha detectado una vulnerabilidad en i-Drive i11 e i12 hasta 20250227. Se ha calificado como crítica. Este problema afecta a una funcionalidad desconocida del componente Device Setting Handler. La manipulación conduce a un control de acceso inadecuado para la interfaz de registro. El ataque debe realizarse dentro de la red local. La complejidad de un ataque es bastante alta. Se sabe que la explotación es difícil. No fue posible identificar al responsable actual del mantenimiento del producto. Se debe asumir que el producto ha llegado al final de su vida útil.
CPE cpe:2.3:o:i-drive:i12_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:i-drive:i11_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:i-drive:i11:*:*:*:*:*:*:*:*
cpe:2.3:h:i-drive:i12:*:*:*:*:*:*:*:*
References () https://github.com/geo-chen/i-Drive - () https://github.com/geo-chen/i-Drive - Third Party Advisory
References () https://vuldb.com/?ctiid.298196 - () https://vuldb.com/?ctiid.298196 - Permissions Required
References () https://vuldb.com/?id.298196 - () https://vuldb.com/?id.298196 - Permissions Required
References () https://vuldb.com/?submit.510955 - () https://vuldb.com/?submit.510955 - Third Party Advisory

03 Mar 2025, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-03 21:15

Updated : 2025-03-05 15:18

NVD link : CVE-2025-1882

Mitre link : CVE-2025-1882

CVE.ORG link : CVE-2025-1882

JSON object : View

Products Affected

i-drive

CWE
CWE-284

Improper Access Control

CWE-1262

Improper Access Control for Register Interface

NVD-CWE-Other