CVE-2025-47872
Medium
Description
The public-facing product registration endpoint server responds differently depending on whether the S/N is valid and unregistered, valid but already registered, or does not exist in the database. Combined with the fact that serial numbers are sequentially assigned, this allows an attacker to gain information on the product registration status of different S/Ns.
SeverityMedium
CVSS5.8
Exploit probability—
ProductEG4 12kPV
PublishedAug 8, 2025
First seenAug 8, 2025
Weakness typeCWE-203CWE-203
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| EG4 Electronics EG4 12kPV | No range specified | — |
| EG4 Electronics EG4 18kPV | No range specified | — |
| EG4 Electronics EG4 Flex 21 | No range specified | — |
| EG4 Electronics EG4 Flex 18 | No range specified | — |
| EG4 Electronics EG4 6000XP | No range specified | — |
| EG4 Electronics EG4 12000XP | No range specified | — |
| EG4 Electronics EG4 GridBoss | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.