CVE-2025-61234 | BDVDB-2026-299989 Detail

Description#

Incorrect access control on Dataphone A920 v2025.07.161103 exposes a service on port 8888 by default on the local network without authentication. This allows an attacker to interact with the device via a TCP socket without credentials. Additionally, sending an HTTP request to the service on port 8888 triggers an error in the response, which exposes the functionality, headers identifying Paytef dataphone packets, and the build version.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12025-10-29Record published in the CVE List.
2. Version 22025-10-30Most recent update recorded in the CVE List.