CVE-2025-4384

The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet become valid. This allows malicious devices to present certificates that are not rejected properly. The use of a client certificate reduces the risk for random devices to take advantage of this flaw.

Scoring

Severity

MEDIUM

CVSS base score

6

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/RE:M/U:Green

EPSS probability

0.13%

CWE

CWE-298

Published

2025-05-06

Last modified

2026-03-13

Affected products

• arcinfo PcVue
• arcinfo PcVue
• arcinfo PcVue

Weakness type

• CWE-298

Related vulnerabilities

• CVE-2026-86231 — mwiede jsch KnownHosts.java getRevokedKeys improper check for certificate revocation
• CVE-2024-1248 — Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation
• CVE-2025-61736 — iSTAR- Improper Validation of Certificate Expiration
• CVE-2025-59036 — Infrahub allows authentication with deleted and expired API tokens
• CVE-2023-42446 — Pow Mnesia cache doesn't invalidate all expired keys on startup

Markdown version · Browse all CVEs