CVE-2025-61234

Incorrect access control on Dataphone A920 v2025.07.161103 exposes a service on port 8888 by default on the local network without authentication. This allows an attacker to interact with the device via a TCP socket without credentials. Additionally, sending an HTTP request to the service on port 8888 triggers an error in the response, which exposes the functionality, headers identifying Paytef dataphone packets, and the build version.

• CWE-284

• https://github.com/stuxve/expose-service-8888-dataphone

Published

Oct 29, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-6122A vulnerability, which was classified as critical, was found…8.8
• CVE-2025-61220The incomplete verification mechanism in the AutoBizLine com…7.5
• CVE-2025-61224Cross Site Scripting vulnerability in DokuWiki 2025-05-14a '…6.5
• CVE-2025-61228An issue in Shirt Pocket SuperDuper! V.3.10 and before allow…7.8
• CVE-2025-61229An issue in Shirt Pocket's SuperDuper! 3.10 and earlier allo…7.8
• CVE-2025-6123A vulnerability has been found in code-projects Restaurant O…9.8
• CVE-2025-61235An issue was discovered in Dataphone A920 v2025.07.161103. A…9.1
• CVE-2025-6124A vulnerability was found in code-projects Restaurant Order …9.8
• CVE-2025-61246indieka900 online-shopping-system-php 1.0 is vulnerable to S…9.8
• CVE-2025-61247indieka900 online-shopping-system-php 1.0 is vulnerable to S…8.2
• CVE-2025-6125A vulnerability was found in PHPGurukul Rail Pass Management…5.4
• CVE-2025-61255Bank Locker Management System by PHPGurukul is affected by a…6.1