CVE-2025-2189: Information Disclosure Vulnerability in Tinxy Smart Devices

Published Mar 11, 2025

Updated

This vulnerability exists in the Tinxy smart devices due to storage of credentials in plaintext within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the plaintext credentials stored on the vulnerable device.

Affected Software

1 affected component

Tinxy Smart Devices

Event History

Mar 11, 2025

CVE Published

via MITRE·11:40 AM

Data Sourced

via MITRE·11:40 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·12:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-2189?

CVE-2025-2189 is classified with a significant severity due to the risk of credential exposure in plaintext.

How do I fix CVE-2025-2189?

To mitigate CVE-2025-2189, ensure that firmware updates are applied that implement secure credential storage practices.

What impact does CVE-2025-2189 have on Tinxy smart devices?

CVE-2025-2189 allows attackers with physical access to extract sensitive plaintext credentials from the device firmware.

Who is affected by CVE-2025-2189?

CVE-2025-2189 affects all models of Tinxy smart devices utilizing firmware that stores credentials in plaintext.

Is physical access required to exploit CVE-2025-2189?

Yes, an attacker must have physical access to the Tinxy smart device to exploit CVE-2025-2189 effectively.