Minimizing network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.
Credit: Anthony Rose, Jacob Krasnov (BC Security)
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2025-8284 | CWE-306 Missing Authentication for Critical Function | 9.8 Critical |
By default, the Packet Power Monitoring and Control Web Interface do not enforce authentication mechanisms. This vulnerability could allow unauthorized users to access and manipulate monitoring and control functions. Mitigation: Packet Power recommends the following: Mitigation: Update the affected products to version 4.1.0 or later. Mitigation: Isolate devices whenever possible. Affected, fixed & timelineAffected:
|
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2025-8284 | 9.8 Critical | Packet Power EMX By default, the Packet Power Monitoring and Control Web Interface do not enforce authentication mechanisms. This vulnerability could allow unauthor… |
Named by the advisory itself. Each CVE links to its tracked detail page.
No KEV-catalogued vendors are named in this publication.