CVE-2025-53520
High
Description
The affected product allows firmware updates to be downloaded from EG4's website, transferred via USB dongles, or installed through EG4's Monitoring Center (remote, cloud-connected interface) or via a serial connection, and can install these files without integrity checks. The TTComp archive format used for the firmware is unencrypted and can be unpacked and altered without detection.
SeverityHigh
CVSS8.8
Exploit probability—
ProductEG4 12kPV
PublishedAug 8, 2025
First seenAug 8, 2025
Weakness typeCWE-494CWE-494
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| EG4 Electronics EG4 12kPV | No range specified | — |
| EG4 Electronics EG4 18kPV | No range specified | — |
| EG4 Electronics EG4 Flex 21 | No range specified | — |
| EG4 Electronics EG4 Flex 18 | No range specified | — |
| EG4 Electronics EG4 6000XP | No range specified | — |
| EG4 Electronics EG4 12000XP | No range specified | — |
| EG4 Electronics EG4 GridBoss | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.