CVE-2025-10879

MediumCVSS 5.3

Published: 25/09/2025(UTC)Updated: 11/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

20th percentile - higher than 20% of all known CVEs

Summary

All versions of Dingtian DT-R002 are vulnerable to an Insufficiently Protected Credentials vulnerability that could allow an attacker to retrieve the current user's username without authentication.

Risk Assessment

The risk is the possibility of disclosing usernames without authorization, which could be used for further attacks such as phishing or brute-force password attacks.

Recommendation

It is recommended to contact the vendor for information about a patch or firmware update. Also monitor the device for unauthorized access.

Other vulnerabilities in Dingtian DT-R002

CVE-2025-10880High
All versions of Dingtian DT-R002 are vulnerable to an Insufficiently Protected Credentials vulnerability that could allow an attacker to extract the proprietary "Dingtian Binary" protocol password by sending an unauthenticated GET request.

Original NVD description (English source)

All versions of Dingtian DT-R002 are vulnerable to an Insufficiently Protected Credentials vulnerability that could allow an attacker to retrieve the current user's username without authentication.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS