CVE-2025-2189: Information Disclosure Vulnerability in Tinxy Smart Devices
First published: Tue Mar 11 2025(Updated: )
This vulnerability exists in the Tinxy smart devices due to storage of credentials in plaintext within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the plaintext credentials stored on the vulnerable device.
Credit: vdisclose@cert-in.org.in
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Tinxy smart devices |
Remedy
Apply mitigations as per vendor instructions (whenever available) or discontinue the use of the product if mitigations are unavailable.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2025-2189?
CVE-2025-2189 is classified with a significant severity due to the risk of credential exposure in plaintext.
How do I fix CVE-2025-2189?
To mitigate CVE-2025-2189, ensure that firmware updates are applied that implement secure credential storage practices.
What impact does CVE-2025-2189 have on Tinxy smart devices?
CVE-2025-2189 allows attackers with physical access to extract sensitive plaintext credentials from the device firmware.
Who is affected by CVE-2025-2189?
CVE-2025-2189 affects all models of Tinxy smart devices utilizing firmware that stores credentials in plaintext.
Is physical access required to exploit CVE-2025-2189?
Yes, an attacker must have physical access to the Tinxy smart device to exploit CVE-2025-2189 effectively.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/description
- agent/remedy
- agent/weakness
- agent/first-publish-date
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/severity
- agent/source
- agent/author
- agent/tags
- agent/event
- vendor/tinxy
- canonical/tinxy smart devices