CVE-2025-4384

published 2025-05-06

CVE-2025-4384: The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet become valid. This allows malicious devices…

Priority P4 24 medium 6 CVSS 4.0

AV A AC L AT P PR N UI N VC N VI H VA N SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU N R U V X RE M U Green

The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet become valid. This allows malicious devices to present certificates that are not rejected properly.

The use of a client certificate reduces the risk for random devices to take advantage of this flaw.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
arcinfo	pcvue	>= 15.0 < 15.2.12	15.2.12
arcinfo	pcvue	>= 16.0 < 16.2.5	16.2.5

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-298