Improper Certificate Validation in PcVue MQTT Add-On
CVE-2025-4384

6MEDIUM

Key Information:

Vendor

Arcinfo

Status
Pcvue
Vendor
CVE Published:
6 May 2025

Badges

👾 Exploit Exists

What is CVE-2025-4384?

The MQTT add-on of PcVue exhibits a significant security flaw by failing to accurately verify the validity of remote device certificates. This oversight permits malicious entities to present expired or otherwise invalid certificates without appropriate rejection. To mitigate the risk associated with this vulnerability, it is advisable to implement client certificates, thereby enhancing security against unauthorized devices.

Affected Version(s)

PcVue 16.0 < 16.2.5

PcVue 15.0

PcVue 16.3.0

References

https://www.pcvue.com/security/#SB2025-3
vendor-advisory

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-4384 : Improper Certificate Validation in PcVue MQTT Add-On