Cooper@Ministraitor
When Responsible Disclosure Becomes A Criminal Investigation: Uncovering CVE-2025-43928 In Law Enforcement Surveillance Systems - Tim Philipp Schäfers #HackLu @hack_lu https://youtu.be/rRpQYS7bTvo
00022172
5.0K followersView on X
CVE-2025-43928(infodraw / pmrs-102)
LOWCVSS 9.8 · CRITICALImmediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
In Infodraw Media Relay Service (MRS) 7.1.0.0, the MRS web server (on port 12654) allows reading arbitrary files via ../ directory traversal in the username field. Reading ServerParameters.xml may reveal administrator credentials in cleartext or with MD5 hashing.
0.0/ 10 priority
Sources & remediation
Exploit / PoC references
Other references
Weakness type (CWE)
CWE-24CWE-22
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
Are you affected?
If you run products in this scope, you should treat this CVE as relevant to your environment.
- pmrs-102
- pmrs-102_firmware
Affected systems
Vendors
Products
pmrs-102pmrs-102_firmware
2 versions affected across 2 products
Deep dive
Full discourse1 post
CPE platform detail2 entries
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | infodraw | pmrs-102 | - | - | - |
| OS | infodraw | pmrs-102_firmware | 7.1.0.0 | - | - |