CVE-2025-25037

published 2025-06-20

CVE-2025-25037: An information disclosure vulnerability exists in Aquatronica Controller System firmware versions <= 5.1.6 and web interface versions <= 2.0. The tcp.php…

Priority P1 83 critical 9.3 CVSS 4.0

AV N AC L AT N PR N UI N VC H VI N VA N SC H SI H SA H E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

ITW EXPLOIT VulnCheck KEV

An information disclosure vulnerability exists in Aquatronica Controller System firmware versions <= 5.1.6 and web interface versions <= 2.0. The tcp.php endpoint fails to restrict unauthenticated access, allowing remote attackers to issue crafted POST requests and retrieve sensitive configuration data, including plaintext administrative credentials. Exploitation of this flaw can lead to full compromise of the system, enabling unauthorized manipulation of connected devices and aquarium parameters.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
aquatronica	aquatronica_controller_system	<= 5.1.6	—

Detection & IOCs extracted from sources · hover to see the quote

path /tcp.php↗

command POST /tcp.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 function_id=tcp_xml_request&command=WS_GET_NETWORK_CFG↗

other WEB_PASSWORD↗

• → Monitor for unauthenticated POST requests to /tcp.php with body parameters 'function_id=tcp_xml_request&command=WS_GET_NETWORK_CFG'; responses containing 'WEB_PASSWORD' and 'pwd=' strings indicate successful exploitation. ↗
• → Shodan query 'html:"aquatronica"' can be used to identify internet-exposed Aquatronica Controller System instances potentially vulnerable to this unauthenticated information disclosure. ↗

• · The vulnerability affects firmware versions <= 5.1.6 and web interface versions <= 2.0; exploitation requires no authentication whatsoever. ↗
• · Successful exploitation returns plaintext administrative credentials in the response body, enabling full system compromise and manipulation of connected aquarium devices. ↗

CVSS provenance

nvd v4.0 9.3 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vulncheck 9.3 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-200