CVE-2025-4130 is a vulnerability classified under CWE-798 (Use of Hard-coded Credentials) affecting PAVO Pay versions before 13.05.2025. The issue allows an attacker to extract sensitive constants from the executable due to embedded hard-coded credentials. The vulnerability is remotely exploitable without authentication or user interaction and results in a high confidentiality impact. No official patch or vendor advisory detailing remediation is available, and the product is not a cloud service, so remediation depends on vendor updates.

The vulnerability allows unauthorized remote attackers to read sensitive information embedded as hard-coded credentials in the PAVO Pay executable. This compromises confidentiality but does not affect integrity or availability. Exploitation requires no privileges or user interaction, increasing risk. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently documented, users should monitor for vendor updates and avoid deploying vulnerable versions where possible. No specific mitigations are provided by the vendor at this time.