CVE-2025-66963 describes a local information disclosure vulnerability in Hitron HI3120 firmware version 7.2.4.5.2b1. The flaw allows a local attacker to access sensitive information through the Logout option on the index.html interface. The vulnerability is categorized as CWE-200, indicating exposure of sensitive information without proper authorization. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects that the attacker requires local access with low attack complexity and low privileges, no user interaction is needed, and the impact is high confidentiality loss without integrity or availability impact. No patch or remediation details are provided in the available data.

The vulnerability allows a local attacker with low privileges to obtain sensitive information from the device, potentially compromising confidentiality. There is no impact on integrity or availability. No known exploits have been reported, so active exploitation is not confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to trusted users only and monitor for unauthorized physical or local network access. No official fix or workaround is currently documented.