CVE-2025-63207
Severity CVSS v4.0:
Pending analysis
Type:
CWE-287
Authentication Issues
Publication date:
19/11/2025
Last modified:
15/01/2026
Description
The R.V.R Elettronica TEX product (firmware TEXL-000400, Web GUI TLAN-000400) is vulnerable to broken access control due to improper authentication checks on the /_Passwd.html endpoint. An attacker can send an unauthenticated POST request to change the Admin, Operator, and User passwords, resulting in complete system compromise.
Impact
Base Score 3.x
9.80
Severity 3.x
CRITICAL
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:rvr:tex30lcd\/s_firmware:texl-000400:*:*:*:*:*:*:* | ||
| cpe:2.3:h:rvr:tex30lcd\/s:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:rvr:tex50lcd\/s_firmware:texl-000400:*:*:*:*:*:*:* | ||
| cpe:2.3:h:rvr:tex50lcd\/s:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:rvr:tex100lcd\/s_firmware:texl-000400:*:*:*:*:*:*:* | ||
| cpe:2.3:h:rvr:tex100lcd\/s:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:rvr:tex150lcd\/s_firmware:texl-000400:*:*:*:*:*:*:* | ||
| cpe:2.3:h:rvr:tex150lcd\/s:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:rvr:tex300lcd_firmware:texl-000400:*:*:*:*:*:*:* | ||
| cpe:2.3:h:rvr:tex300lcd:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:rvr:tex502lcd_firmware:texl-000400:*:*:*:*:*:*:* | ||
| cpe:2.3:h:rvr:tex502lcd:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:rvr:tex702lcd_firmware:texl-000400:*:*:*:*:*:*:* | ||
| cpe:2.3:h:rvr:tex702lcd:-:*:*:*:*:*:*:* | ||
| cpe:2.3:o:rvr:tex3500lcd_firmware:texl-000400:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page