QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2025-53520

Back to search

CVE-2025-53520

Published: Aug 8, 2025

Modified: Aug 8, 2025

PUBLISHED

CVSS v3.1

8.8

HIGH

Description

The affected product allows firmware updates to be downloaded from EG4's website, transferred via USB dongles, or installed through EG4's Monitoring Center (remote, cloud-connected interface) or via a serial connection, and can install these files without integrity checks. The TTComp archive format used for the firmware is unencrypted and can be unpacked and altered without detection.

VendorProductVersions

EG4 Electronics

EG4 12kPV

affected
all versions

EG4 Electronics

EG4 18kPV

affected
all versions

EG4 Electronics

EG4 Flex 21

affected
all versions

EG4 Electronics

EG4 Flex 18

affected
all versions

EG4 Electronics

EG4 6000XP

affected
all versions

EG4 Electronics

EG4 12000XP

affected
all versions

EG4 Electronics

EG4 GridBoss

affected
all versions

Weaknesses (CWE)

CWE-494

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now