{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.1",
    "cveMetadata": {
        "cveId": "CVE-2025-0681",
        "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "state": "PUBLISHED",
        "assignerShortName": "icscert",
        "dateReserved": "2025-01-23T16:50:56.326Z",
        "datePublished": "2025-01-30T18:53:09.669Z",
        "dateUpdated": "2025-01-30T19:11:58.156Z"
    },
    "containers": {
        "cna": {
            "affected": [
                {
                    "defaultStatus": "unaffected",
                    "product": "OM500 IP-PBX",
                    "vendor": "New Rock Technologies",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "All"
                        }
                    ]
                },
                {
                    "defaultStatus": "unaffected",
                    "product": "MX8G VoIP Gateway",
                    "vendor": "New Rock Technologies",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "All"
                        }
                    ]
                },
                {
                    "defaultStatus": "unaffected",
                    "product": "NRP1302/P Desktop IP Phone",
                    "vendor": "New Rock Technologies",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "All"
                        }
                    ]
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "type": "finder",
                    "value": "Tomer Goldschmidt of Claroty Team82 reported these vulnerabilities to CISA."
                }
            ],
            "datePublic": "2025-01-30T17:26:00.000Z",
            "descriptions": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "The Cloud MQTT service of the affected products supports wildcard topic \nsubscription which could allow an attacker to obtain sensitive \ninformation from tapping the service communications."
                        }
                    ],
                    "value": "The Cloud MQTT service of the affected products supports wildcard topic \nsubscription which could allow an attacker to obtain sensitive \ninformation from tapping the service communications."
                }
            ],
            "metrics": [
                {
                    "cvssV4_0": {
                        "Automatable": "NOT_DEFINED",
                        "Recovery": "NOT_DEFINED",
                        "Safety": "NOT_DEFINED",
                        "attackComplexity": "LOW",
                        "attackRequirements": "NONE",
                        "attackVector": "LOCAL",
                        "baseScore": 6.9,
                        "baseSeverity": "MEDIUM",
                        "privilegesRequired": "NONE",
                        "providerUrgency": "NOT_DEFINED",
                        "subAvailabilityImpact": "NONE",
                        "subConfidentialityImpact": "NONE",
                        "subIntegrityImpact": "NONE",
                        "userInteraction": "NONE",
                        "valueDensity": "NOT_DEFINED",
                        "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
                        "version": "4.0",
                        "vulnAvailabilityImpact": "NONE",
                        "vulnConfidentialityImpact": "HIGH",
                        "vulnIntegrityImpact": "NONE",
                        "vulnerabilityResponseEffort": "NOT_DEFINED"
                    },
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ]
                },
                {
                    "cvssV3_1": {
                        "attackComplexity": "LOW",
                        "attackVector": "LOCAL",
                        "availabilityImpact": "NONE",
                        "baseScore": 6.2,
                        "baseSeverity": "MEDIUM",
                        "confidentialityImpact": "HIGH",
                        "integrityImpact": "NONE",
                        "privilegesRequired": "NONE",
                        "scope": "UNCHANGED",
                        "userInteraction": "NONE",
                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                        "version": "3.1"
                    },
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ]
                }
            ],
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "cweId": "CWE-155",
                            "description": "CWE-155",
                            "lang": "en",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "providerMetadata": {
                "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
                "shortName": "icscert",
                "dateUpdated": "2025-01-30T18:53:09.669Z"
            },
            "references": [
                {
                    "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-030-02"
                },
                {
                    "url": "https://www.newrocktech.com/ContactUs/index.html"
                }
            ],
            "source": {
                "advisory": "ICSA-25-030-02",
                "discovery": "EXTERNAL"
            },
            "title": "New Rock Technologies Cloud Connected Devices  Improper Neutralization of Wildcards or Matching Symbols",
            "workarounds": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "New Rock Technologies has not responded to requests to work with CISA to\n mitigate these vulnerabilities. Users of affected versions of New Rock \nTechnologies Cloud Connected Devices are invited to contact New Rock \nTechnologies <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.newrocktech.com/ContactUs/index.html\">customer support</a> for additional information.\n\n<br>"
                        }
                    ],
                    "value": "New Rock Technologies has not responded to requests to work with CISA to\n mitigate these vulnerabilities. Users of affected versions of New Rock \nTechnologies Cloud Connected Devices are invited to contact New Rock \nTechnologies  customer support https://www.newrocktech.com/ContactUs/index.html  for additional information."
                }
            ],
            "x_generator": {
                "engine": "Vulnogram 0.2.0"
            }
        },
        "adp": [
            {
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2025-01-30T19:11:47.355418Z",
                                "id": "CVE-2025-0681",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "partial"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2025-01-30T19:11:58.156Z"
                }
            }
        ]
    }
}