CVE-2025-67159 identifies a vulnerability in Vatilon v1.12.37-20240124 where user credentials are transmitted in plaintext over the network. This cleartext transmission (CWE-319) enables an attacker with network access to intercept and obtain sensitive authentication data. The vulnerability has a CVSS v3.1 base score of 7.5, reflecting high severity due to network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact. No known exploits in the wild or vendor patches have been reported as of the published date.

The vulnerability exposes user credentials to interception by attackers with network access, potentially leading to unauthorized access if credentials are reused or systems lack additional protections. The confidentiality of user credentials is fully compromised, but integrity and availability are not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid transmitting sensitive credentials over untrusted networks or use additional protective measures such as VPNs or network encryption layers to mitigate interception risk.