Cyber Resilience

CVE-2025-6529

HighPublic PoC

Published: 23 June 2025

Published
23 June 2025
Modified
29 April 2026
KEV Added
Patch
CVSS Score v4 7.4 CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0051 66.8th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-6529 is a high-severity Use of Default Credentials (CWE-1392) vulnerability in 70Mai M300 Firmware. Its CVSS base score is 7.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Default Accounts (T1078.001); ranked in the top 33.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

A vulnerability was found in 70mai M300 up to 20250611 and classified as critical. Affected by this issue is some unknown functionality of the component Telnet Service. The manipulation leads to use of default credentials. The attack needs to be…

more

initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1078.001 Default Accounts Stealth
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
T1105 Ingress Tool Transfer Command And Control
Adversaries may transfer tools or other files from an external system into a compromised environment.
Why these techniques?

Default credentials in Telnet service (port 23) enable use of valid default accounts for authentication, granting shell access for Unix shell command execution (RCE) and uploading arbitrary malicious files.

Affected Assets

70mai
m300 firmware
≤ 2025-06-11

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-1392

Mandates replacement of default credentials during secure configuration and provisioning procedures.

addresses: CWE-1392

Policy requires changing or avoiding default credentials during system setup and operation.

addresses: CWE-1392

Unique identification requirement prevents use of default or shared credentials by organizational users.

addresses: CWE-1392

Changing default authenticators prior to first use prevents use of default credentials.

addresses: CWE-1392

Standards-compliant authentication mechanisms typically prohibit default credentials for cryptographic modules.

addresses: CWE-1392

Consistent implementation of the strategy drives removal or mitigation of default credentials in procured systems and services.

addresses: CWE-1392

Security functional requirements and acceptance criteria can stipulate that acquired systems must not use default credentials.

addresses: CWE-1392

Documentation of known configuration vulnerabilities and secure setup practices reduces reliance on default credentials.

References