CVE-2025-44612 is a medium-severity vulnerability affecting the Tinxy WiFi Lock Controller v1 RF. The core issue is that the device transmits sensitive information, including control commands and device credentials, in plaintext over its radio frequency communication channel. This lack of encryption or secure transmission protocols exposes the device to man-in-the-middle (MitM) attacks, where an attacker within radio range can intercept and capture these sensitive data packets. By obtaining control information and credentials, an attacker could potentially gain unauthorized access to the lock controller, manipulate lock states, or further compromise the security of the physical premises controlled by the device. The vulnerability is classified under CWE-319, which relates to the transmission of sensitive information in cleartext. The CVSS v3.1 base score is 5.9, indicating a medium severity level. The vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N indicates that the attack is network-based (remote), requires high attack complexity, no privileges or user interaction, and impacts confidentiality with high impact but no impact on integrity or availability. No patches or vendor mitigations are currently available, and no known exploits have been reported in the wild as of the publication date. The vulnerability was published on May 30, 2025, and reserved on April 22, 2025.

For European organizations, this vulnerability poses a significant risk especially to entities relying on Tinxy WiFi Lock Controllers for physical security, such as offices, data centers, warehouses, or residential buildings. The exposure of control commands and credentials in plaintext could allow attackers to bypass physical security controls remotely, leading to unauthorized physical access. This could result in theft, espionage, or sabotage, especially in sectors with high-value assets or sensitive information. The medium CVSS score reflects that exploitation requires proximity (within RF range) and some technical skill due to the high attack complexity, but the confidentiality impact is high since credentials and control data are exposed. Organizations in Europe with deployments of these devices must consider the risk of targeted attacks, particularly in urban areas where attackers can easily be within RF range. Additionally, the lack of integrity and availability impact means attackers cannot directly alter commands or cause denial of service, but the confidentiality breach alone is critical for physical security.

Given the absence of vendor patches, European organizations should implement compensating controls immediately. These include: 1) Physically securing the environment to limit attacker proximity to the RF signal range, such as restricting access to building perimeters and sensitive areas. 2) Deploying RF shielding or signal jamming solutions where feasible to reduce the risk of interception. 3) Monitoring network traffic and physical access logs for anomalous activity that could indicate exploitation attempts. 4) Considering replacement or upgrade of the Tinxy WiFi Lock Controllers with devices that support encrypted communication protocols (e.g., TLS, WPA3) and secure credential handling. 5) Implementing multi-factor physical access controls, such as biometric verification or secondary authentication mechanisms, to reduce reliance on the vulnerable device alone. 6) Educating security personnel about the risks of RF interception and ensuring incident response plans include scenarios involving physical security device compromise.