Base Score

LOW3.1

CVE-2025-62772

On Mercku M6a devices through 2.1.0, session tokens remain valid for at least months in some cases.

VectorADJACENT_NETWORK

Published Bycve@mitre.org

Published DateOct 22, 2025, 04:16

Weakness Type (CWE):CWE-305

CVSS Metrics

Base Score

3.1

Vector String

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Base Severity

LOW

Version

3.1

Attack Vector (AV)

ADJACENT_NETWORK

Attack Complexity (AC)

HIGH

Privileges Required (PR)

NONE

User Interaction (UI)

NONE

Scope (S)

UNCHANGED

Confidentiality (C)

NONE

Integrity (I)

LOW

Availability (A)

NONE

References

https://blog.nullvoid.me/posts/mercku-exploits/
https://seclists.org/fulldisclosure/2025/Oct/10

Base Score

LOW3.1

Weakness Type (CWE):CWE-305

CVSS Metrics

Base Score

3.1

Vector String

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Base Severity

LOW

Version

3.1

Attack Vector (AV)

ADJACENT_NETWORK

Attack Complexity (AC)

HIGH

Privileges Required (PR)

NONE

User Interaction (UI)

NONE

Scope (S)

UNCHANGED

Confidentiality (C)

NONE

Integrity (I)

LOW

Availability (A)

NONE