CVE-2025-13954: Hard-coded cryptographic keys in EZCast Pro II Dongle

Severity: critical (CVSS 9.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-10 · updated 2026-10-14
Weakness: CWE-798

Description

Hard-coded cryptographic keys in Admin UI of EZCast Pro II before version 1.17478.177 allows attackers to bypass authorization checks and gain full access to the admin UI

Affected products

EZCast Pro II: before 1.17478.177 — fixed in 1.17478.177

How to fix

Upgrade to a fixed version: EZCast Pro II 1.17478.177. Check the vendor advisory for mitigations.

References

https://www.ncsc.admin.ch/ncsc/en/home/infos-fuer/infos-it-spezialisten/themen/schwachstelle-melden/cvd-cases/cvd-case-1-test.html
https://www.nimbletech.com.tw/index.php/release-note/

Get alerted when CVE-2025-13954 or the next vulnerability affects your stack