VulnSocial

CVE-2025-25037Active Exploitation

MEDIUMCVSS 9.3 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

An information disclosure vulnerability exists in Aquatronica Controller System firmware versions <= 5.1.6 and web interface versions <= 2.0. The tcp.php endpoint fails to restrict unauthenticated access, allowing remote attackers to issue crafted POST requests and retrieve sensitive configuration data, including plaintext administrative credentials. Exploitation of this flaw can lead to full compromise of the system, enabling unauthorized manipulation of connected devices and aquarium parameters.

Back to dashboard
5.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-200

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

NONE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Public PoC is present in monitored signal
  • 1 mentions across 1 observed day

What's happening

  • Active exploitation reported across 1 signal
  • PoC mentioned or linked in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-04-07: 1PoC Mentioned / Linked · 2026-04-07: 1Active Exploitation · 2026-04-07: 1Technical Details · 2026-04-07: 104-07
Signal classification1 categories
Active Exploitation
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • 0day Signal@0dayPublishing
    Active Exploitation

    🚨 CVE-2025-25037: Aquatronica Controller System Co... Unauthenticated tcp.php endpoint spills plaintext admin creds via crafted POST - aquarium controllers become IoT botnet... https://zerodaysignal.com/vulnerability/CVE-2025-25037 #netsec #vulnerability #CVE #sysadmin #zeroday

    Post summary

    CVE-2025-25037 allows unauthenticated access to a tcp.php endpoint, leaking plaintext admin credentials and enabling aquarium controllers to be hijacked into an IoT botnet; PoC information is available via ZeroDaySignal.

    00000165
    204 followersView on X

Explore more

Back to dashboard