CVE-2025-2189
Medium
Description
This vulnerability exists in the Tinxy smart devices due to storage of credentials in plaintext within the device firmware. An attacker with physical access could exploit this by extracting the firmware and analyzing the binary data to obtain the plaintext credentials stored on the vulnerable device.
SeverityMedium
CVSS5.1
Exploit probability—
ProductTinxy Wi-Fi Lock Controller v1 RF
PublishedMar 11, 2025
First seenMar 11, 2025
Weakness typeCWE-312CWE-312
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Mogify Infotech Tinxy Wi-Fi Lock Controller v1 RF | No range specified | — |
| Mogify Infotech Tinxy Door Lock with Wi-Fi Controller | No range specified | — |
| Mogify Infotech Tinxy 1 Node 10A and 16A Smart Wi-Fi Switches | No range specified | — |
| Mogify Infotech Tinxy 2, 4 and 6 Node Smart Wi-Fi Switches | No range specified | — |
| Mogify Infotech Tinxy Smart 15 Watts 3 in 1 Square Panel Ceiling Light | No range specified | — |
| Mogify Infotech Tinxy Smart 8 Watts 3 in 1 Round Panel Ceiling Light | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.