CVE-2025-63207

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-11-19 · updated 2026-06-17
Weakness: CWE-287

Description

The R.V.R Elettronica TEX product (firmware TEXL-000400, Web GUI TLAN-000400) is vulnerable to broken access control due to improper authentication checks on the /_Passwd.html endpoint. An attacker can send an unauthenticated POST request to change the Admin, Operator, and User passwords, resulting in complete system compromise.

Affected products

Rvr Tex1002Lcd Firmware: texl-000400
Rvr Tex100Lcd/S Firmware: texl-000400
Rvr Tex150Lcd/S Firmware: texl-000400
Rvr Tex2000Light Firmware: texl-000400
Rvr Tex2500Lcd Firmware: texl-000400
Rvr Tex300Lcd Firmware: texl-000400
Rvr Tex30Lcd/S Firmware: texl-000400
Rvr Tex3500Lcd Firmware: texl-000400
Rvr Tex502Lcd Firmware: texl-000400
Rvr Tex50Lcd/S Firmware: texl-000400
Rvr Tex702Lcd Firmware: texl-000400

References

https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63207_RVR%20Elettronica%20TEX%20Broken%20Access%20Control
https://www.rvr.it/en/
https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63207_RVR%20Elettronica%20TEX%20Broken%20Access%20Control

Get alerted when CVE-2025-63207 or the next vulnerability affects your stack