CVE-2025-63209: Information Exposure
Source CVE Database V5
Not known to be exploited · CVSS 7.5 High.
Data as of 26 Oct 2026, 09:15 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 37% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 19 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
1. Immediately restrict network access to the /setup.xml endpoint by implementing firewall rules or access control lists (ACLs) to allow only trusted management IP addresses. 2. Employ network segmentation to isolate transmitter devices from general enterprise networks and the internet, reducing exposure. 3. Monitor network traffic for unusual requests targeting /setup.xml or other configuration endpoints. 4. Change default or known admin passwords on affected devices to strong, unique credentials once access is secured. 5. Engage with ELCA or authorized vendors to obtain firmware updates or patches addressing this vulnerability as soon as they become available. 6. If firmware updates are not yet available, consider temporary compensating controls such as VPN access for device management or disabling remote management features where feasible. 7. Conduct regular security audits and vulnerability assessments on transmitter infrastructure to detect similar issues. 8. Train operational staff on the risks of exposing management interfaces and the importance of secure configuration.
Description
The ELCA Star Transmitter Remote Control firmware 1.25 for STAR150, BP1000, STAR300, STAR2000, STAR1000, STAR500, and possibly other models, contains an information disclosure vulnerability allowing unauthenticated attackers to retrieve admin credentials and system settings via an unprotected /setup.xml endpoint. The admin password is stored in plaintext under the <p05> XML tag, potentially leading to remote compromise of the transmitter system.