CVE-2025-2189
Information Disclosure Vulnerability in Tinxy Smart Devices
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
This vulnerability exists in the Tinxy smart devices due to storage of credentials in plaintext within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the plaintext credentials stored on the vulnerable device.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Mogify Infotech Tinxy Wi-Fi Lock Controller v1 RF
All versions
- Mogify Infotech Tinxy Door Lock with Wi-Fi Controller
All versions
- Mogify Infotech Tinxy 1 Node 10A and 16A Smart Wi-Fi Switches
All versions
- Mogify Infotech Tinxy 2, 4 and 6 Node Smart Wi-Fi Switches
All versions
- Mogify Infotech Tinxy Smart 15 Watts 3 in 1 Square Panel Ceiling Light
All versions
- Mogify Infotech Tinxy Smart 8 Watts 3 in 1 Round Panel Ceiling Light
All versions