CVE-2025-3606 HIGH

CVE-2025-3606: Vestel AC Charger Exposure of Sensitive System Information to an Unauthorized Control Sphere

Vendor Vestel

Product AC Charger EVC04

Weakness CWE-497

Published April 24, 2025

Last update April 25, 2025

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Vestel AC Charger version 3.75.0 contains a vulnerability that could enable an attacker to access files containing sensitive information, such as credentials which could be used to further compromise the device.

Key dates

02Disclosure timeline

April 24, 2025 CVE published

April 25, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-3606 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/497.html

Related vulnerabilities

04Related CVE

CVE-2025-67567 WordPress Sober theme <= 3.5.11 - Sensitive Data Exposure vulnerability CVE-2023-37525 HCL BigFix Compliance is vulnerable to a sensitive information disclosure CVE-2025-8700 Privilege Escalation via get-task-allow entitlement in Invoice Ninja CVE-2025-64258 WordPress Follow My Blog Post plugin <= 2.3.9 - Sensitive Data Exposure vulnerability CVE-2025-68576 WordPress Virusdie plugin <= 1.1.6 - Sensitive Data Exposure vulnerability