{"id":"CVE-2025-25281","state":"PUBLISHED","title":"Outback Power Mojave Inverter Exposure of Sensitive Information to an Unauthorized Actor","description":"An attacker may modify the URL to discover sensitive information about the target network.","publishedAt":"2025-02-13T21:18:56.425Z","updatedAt":"2025-02-14T15:47:48.300Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","source":"icscert"},"assigner":"icscert","products":["Outback Power Mojave Inverter"],"affected":[{"vendor":"Outback Power","product":"Mojave Inverter","defaultStatus":"unaffected","versions":[{"version":"All versions","status":"affected"}]}],"references":["https://www.cisa.gov/news-events/ics-advisories/icsa-25-044-17","https://old.outbackpower.com/about-outback/contact/contact-us"],"weaknesses":["CWE-200"],"ingestedAt":"2026-10-29T20:08:47.682Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/25xxx/CVE-2025-25281.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-25281","state":"PUBLISHED","datePublished":"2025-02-13T21:18:56.425Z","dateUpdated":"2025-02-14T15:47:48.300Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2025-02-12T16:21:30.252Z"},"containers":{"cna":{"title":"Outback Power Mojave Inverter Exposure of Sensitive Information to an Unauthorized Actor","descriptions":[{"lang":"en","value":"An attacker may modify the URL to discover sensitive information about the target network."}],"affected":[{"vendor":"Outback Power","product":"Mojave Inverter","defaultStatus":"unaffected","versions":[{"version":"All versions","status":"affected"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-25-044-17"},{"url":"https://old.outbackpower.com/about-outback/contact/contact-us"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2025-02-13T21:18:56.425Z"},"credits":[{"lang":"en","type":"finder","value":"Jon Hurtado of Sandia National Laboratory reported these vulnerabilities to CISA."}],"source":{"advisory":"ICSA-25-044-17","discovery":"EXTERNAL"},"workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The Mojave Inverter was a product of Enersys. When Outback Power was \nsplit off from Enersys recently, Mojave Inverter was moved to Outback \nPower, but without the resources to maintain the product. Outback Power \nmay discontinue this product and has not yet addressed these \nvulnerabilities. CISA recommends disabling the networking features of \nthis product until a replacement product can be acquired.\n\n<br>"}],"value":"The Mojave Inverter was a product of Enersys. When Outback Power was \nsplit off from Enersys recently, Mojave Inverter was moved to Outback \nPower, but without the resources to maintain the product. Outback Power \nmay discontinue this product and has not yet addressed these \nvulnerabilities. CISA recommends disabling the networking features of \nthis product until a replacement product can be acquired."}],"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-02-14T15:37:15.584581Z","id":"CVE-2025-25281","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-14T15:47:48.300Z"}}]}}}