CVE-2025-8731
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-8731 is a high-severity Use of Default Credentials (CWE-1392) vulnerability. Its CVSS base score is 8.9 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Default Accounts (T1078.001); ranked at the 47th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and IA-5 (Authenticator Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-8731 is a vulnerability involving the use of default credentials in an unknown part of the SSH service on TRENDnet devices TI-G160i, TI-PG102i, and TPL-430AP, affecting versions up to firmware 20250724. Classified under CWE-1392 with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), it allows attackers to manipulate the service remotely.
Attackers with network access can exploit this vulnerability without authentication privileges, user interaction, or special conditions, potentially achieving high confidentiality, integrity, and availability impacts, such as full remote compromise of the affected devices via the default credentials.
Vendor advisories note that remote management is disabled by default on TI-PG102i and TI-G160i, with the root account intended for troubleshooting and its password encrypted; the vendor plans to remove this account in the next firmware release. For TPL-430AP, the initial setup requires users to set a management GUI password, after which the default password becomes invalid. The existence of the vulnerability is currently doubted, though an exploit has been publicly disclosed.
Exploitation details are available in referenced sources, including a GitHub PDF documenting vulnerabilities in TPL-430AP firmware 1.0.1 and VulDB entries, but no confirmed real-world exploitation is reported.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-23997
Vulnerability Data
A vulnerability was identified in TRENDnet TI-G160i, TI-PG102i and TPL-430AP up to 20250724. This affects an unknown part of the component SSH Service. The manipulation leads to use of default credentials. It is possible to initiate the attack remotely. The…
more
exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The vendor explains: "For product TI-PG102i and TI-G160i, by default, the product's remote management options are all disabled. The root account is for troubleshooting purpose and the password is encrypted. However, we will remove the root account from the next firmware release. For product TPL-430AP, the initial setup process requires user to set the password for the management GUI. Once that was done, the default password will be invalid."
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V13.2.1
Mitigating Controls (NIST 800-53 r5) AI
Secure configuration settings establish baselines that prohibit default credentials on system components.
Authenticator management requires verification of identity and secure distribution of initial authenticators, directly stopping default credentials from being left in place.
Vulnerability scanning can discover default credentials after deployment but does not stop their introduction.
Account management processes include assignment and control of initial account credentials, reducing the chance defaults remain active.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardened baselines and configuration management explicitly prohibit default credentials on deployed systems.
Credential management processes directly require replacing or disabling default passwords and keys.
Authentication policies can enforce non-default credential strength but do not explicitly address initial deployment defaults.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
The requirement to replace vendor default authentication information immediately after installation directly counters the use of default credentials that attackers commonly target.