CVE-2025-61234: Incorrect access control on Dataphone A920 v2025.07.161103 exposes a service on port 8888 by default
Source GCVE Database
Not known to be exploited · CVSS 7.5 High.
Data as of 29 Oct 2026, 23:18 UTC
Thin evidence
One scorer or none| CISA-ADP | CVSS 3.1 | 7.5 |
|---|
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 29 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 29 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
GitHubstuxve/expose-service-8888-dataphonepkg:github/stuxve/expose-service-8888-dataphoneOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Since the device is not a cloud service, users should restrict local network access to the device and disable or block access to port 8888 if possible until a fix is released. Monitor vendor advisories for updates and apply any official fixes once available.
Description
Dataphone A920 version 2025.07.161103 has an incorrect access control vulnerability that exposes a service on port 8888 by default on the local network without requiring authentication. This allows unauthenticated attackers to interact with the device via a TCP socket. Additionally, sending an HTTP request to this service triggers an error response that reveals internal functionality, headers identifying Paytef dataphone packets, and the device's build version.