Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2025-4384Certificate validity not properly verified

Description

The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet become valid. This allows malicious devices to present certificates that are not rejected properly. The use of a client certificate reduces the risk for random devices to take advantage of this flaw.

Timeline

  1. ID reserved

    By arcinfo

  2. Published

  3. · 4 months later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2025-4384, by who scored it
Scored byCVSSScoreVector
arcinfoCNA (assigner)4.0Medium6.0CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/RE:M/U:Green
NVDNVD · Deferred4.0Medium6.0CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:M/U:Green
EPSS (exploitation in 30 days)
0.13% · top 97% of all CVEs (12 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.0.

Affected products

  • arcinfo · PcVue

    • unaffected 16.3.0
    • affected 16.0 – < 16.2.5
    • affected 15.0 – < 15.2.12

What to do

Solution: Harden the configuration Who should apply this recommendation: All users The system operators are highly recommended to take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should: * Use client certificate when configuring the MQTT add-on. * Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet unless required. * Locate control system networks and remote devices behind firewalls and isolate them from business networks. * When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices. Update PcVue Who should apply this recommendation: All users using the affected component Apply the patch by installing a fixed PcVue version. Available patches: Fixed in: * PcVue 16.2.5 and PcVue 16.3.0 * PcVue 15.2.12

Exploitation: No POC available.

Exploitation: Not known to be exploited.

References

References1

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2025-4384 badge
[![CVE-2025-4384](https://cveledger.app/badge/CVE-2025-4384.svg)](https://cveledger.app/cve/CVE-2025-4384)

Record last updated .