CVE-2020-25749

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-09-25 · updated 2026-06-17
Weakness: CWE-798

Description

The Telnet service of Rubetek cameras RV-3406, RV-3409, and RV-3411 cameras (firmware versions v342, v339) could allow an remote attacker to take full control of the device with a high-privileged account. The vulnerability exists because a system account has a default and static password. The Telnet service cannot be disabled and this password cannot be changed via standard functionality.

Affected products

Rubetek Rv-3406 Firmware: 339, 342
Rubetek Rv-3409 Firmware: 339, 342
Rubetek Rv-3411 Firmware: 339, 342

References

https://github.com/jet-pentest/CVE-2020-25749
https://github.com/jet-pentest/CVE-2020-25749

Get alerted when CVE-2020-25749 or the next vulnerability affects your stack