Vulnerability-Lookup

CVE-2025-1073 (GCVE-0-2025-1073)

Vulnerability from cvelistv5 – Published: 2025-04-10 11:16 – Updated: 2025-04-15 03:39

Summary

Panasonic IR Control Hub (IR Blaster) versions 1.17 and earlier may allow an attacker with physical access to load unauthorized firmware onto the device.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-04-10 13:01 UTC

CWE

CWE-1299 - Missing Protection Mechanism for Alternate Hardware Interface

Assigner

Panasonic_Holdings_Corporation jpcert root

References

1 reference

URL	Tags
https://lsin.panasonic.com/release-notes

Impacted products

1 product

Vendor	Product	Version	CPE status
Panasonic	IR Control Hub (IR Blaster)	Affected: 1.17 and earlier (custom)	guessed

Credits

Shravan Singh

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-1073",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-10T13:01:42.557304Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-10T13:02:23.198Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "IR Control Hub (IR Blaster)",
          "vendor": "Panasonic",
          "versions": [
            {
              "status": "affected",
              "version": "1.17 and earlier",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Shravan Singh"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Panasonic IR Control Hub (IR Blaster) versions 1.17 and earlier may allow an attacker with physical access to load unauthorized firmware onto the device.\n\n\u003cbr\u003e"
            }
          ],
          "value": "Panasonic IR Control Hub (IR Blaster) versions 1.17 and earlier may allow an attacker with physical access to load unauthorized firmware onto the device."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "LOW",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1299",
              "description": "CWE-1299: Missing Protection Mechanism for Alternate Hardware Interface",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-15T03:39:35.888Z",
        "orgId": "2163caeb-3942-4e93-a74b-8c75338146ce",
        "shortName": "Panasonic_Holdings_Corporation"
      },
      "references": [
        {
          "url": "https://lsin.panasonic.com/release-notes"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2163caeb-3942-4e93-a74b-8c75338146ce",
    "assignerShortName": "Panasonic_Holdings_Corporation",
    "cveId": "CVE-2025-1073",
    "datePublished": "2025-04-10T11:16:33.999Z",
    "dateReserved": "2025-02-06T06:36:17.394Z",
    "dateUpdated": "2025-04-15T03:39:35.888Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-1073",
      "date": "2026-09-16",
      "epss": "0.00218",
      "percentile": "0.12421"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-1073\",\"sourceIdentifier\":\"product-security@gg.jp.panasonic.com\",\"published\":\"2025-04-10T12:15:15.097\",\"lastModified\":\"2026-06-17T08:38:20.203\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Panasonic IR Control Hub (IR Blaster) versions 1.17 and earlier may allow an attacker with physical access to load unauthorized firmware onto the device.\"},{\"lang\":\"es\",\"value\":\" Las versiones 1.17 y anteriores del Panasonic IR Control Hub (IR Blaster) pueden permitir que un atacante con acceso f\u00edsico cargue firmware no autorizado en el dispositivo.\"}],\"affected\":[{\"source\":\"product-security@gg.jp.panasonic.com\",\"affectedData\":[{\"vendor\":\"Panasonic\",\"product\":\"IR Control Hub (IR Blaster)\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"1.17 and earlier\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"product-security@gg.jp.panasonic.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"PHYSICAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":0.9,\"impactScore\":6.0}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-04-10T13:01:42.557304Z\",\"id\":\"CVE-2025-1073\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"product-security@gg.jp.panasonic.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1299\"}]}],\"references\":[{\"url\":\"https://lsin.panasonic.com/release-notes\",\"source\":\"product-security@gg.jp.panasonic.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-1073\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-10T13:01:42.557304Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-10T13:02:17.072Z\"}}], \"cna\": {\"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Shravan Singh\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"PHYSICAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Panasonic\", \"product\": \"IR Control Hub (IR Blaster)\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.17 and earlier\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://lsin.panasonic.com/release-notes\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Panasonic IR Control Hub (IR Blaster) versions 1.17 and earlier may allow an attacker with physical access to load unauthorized firmware onto the device.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Panasonic IR Control Hub (IR Blaster) versions 1.17 and earlier may allow an attacker with physical access to load unauthorized firmware onto the device.\\n\\n\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1299\", \"description\": \"CWE-1299: Missing Protection Mechanism for Alternate Hardware Interface\"}]}], \"providerMetadata\": {\"orgId\": \"2163caeb-3942-4e93-a74b-8c75338146ce\", \"shortName\": \"Panasonic_Holdings_Corporation\", \"dateUpdated\": \"2025-04-15T03:39:35.888Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-1073\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-15T03:39:35.888Z\", \"dateReserved\": \"2025-02-06T06:36:17.394Z\", \"assignerOrgId\": \"2163caeb-3942-4e93-a74b-8c75338146ce\", \"datePublished\": \"2025-04-10T11:16:33.999Z\", \"assignerShortName\": \"Panasonic_Holdings_Corporation\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2025-1073

Vulnerability from fkie_nvd - Published: 2025-04-10 12:15 - Updated: 2026-06-17 08:38

Severity

7.5 (High) - CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Summary

Panasonic IR Control Hub (IR Blaster) versions 1.17 and earlier may allow an attacker with physical access to load unauthorized firmware onto the device.

References

	URL	Tags
	product-security@gg.jp.panasonic.com	https://lsin.panasonic.com/release-notes

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "IR Control Hub (IR Blaster)",
          "vendor": "Panasonic",
          "versions": [
            {
              "status": "affected",
              "version": "1.17 and earlier",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "product-security@gg.jp.panasonic.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Panasonic IR Control Hub (IR Blaster) versions 1.17 and earlier may allow an attacker with physical access to load unauthorized firmware onto the device."
    },
    {
      "lang": "es",
      "value": " Las versiones 1.17 y anteriores del Panasonic IR Control Hub (IR Blaster) pueden permitir que un atacante con acceso f\u00edsico cargue firmware no autorizado en el dispositivo."
    }
  ],
  "id": "CVE-2025-1073",
  "lastModified": "2026-06-17T08:38:20.203",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "PHYSICAL",
          "availabilityImpact": "LOW",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 6.0,
        "source": "product-security@gg.jp.panasonic.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-1073",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-04-10T13:01:42.557304Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-04-10T12:15:15.097",
  "references": [
    {
      "source": "product-security@gg.jp.panasonic.com",
      "url": "https://lsin.panasonic.com/release-notes"
    }
  ],
  "sourceIdentifier": "product-security@gg.jp.panasonic.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1299"
        }
      ],
      "source": "product-security@gg.jp.panasonic.com",
      "type": "Secondary"
    }
  ]
}

GHSA-J3FQ-6CWX-WGX7

Vulnerability from github – Published: 2025-04-10 12:31 – Updated: 2025-04-10 12:31

Details

Panasonic IR Control Hub (IR Blaster) versions 1.17 and earlier may allow an attacker with physical access to load unauthorized firmware onto the device.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-1073"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1299"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-10T12:15:15Z",
    "severity": "HIGH"
  },
  "details": "Panasonic IR Control Hub (IR Blaster) versions 1.17 and earlier may allow an attacker with physical access to load unauthorized firmware onto the device.",
  "id": "GHSA-j3fq-6cwx-wgx7",
  "modified": "2025-04-10T12:31:27Z",
  "published": "2025-04-10T12:31:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1073"
    },
    {
      "type": "WEB",
      "url": "https://lsin.panasonic.com/release-notes"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L",
      "type": "CVSS_V3"
    }
  ]
}

JVNDB-2025-004863

Vulnerability from jvndb - Published: 2025-05-14 02:30 - Updated:2025-05-14 02:30

Summary

Panasonic IR Control Hub vulnerable to Unauthorised firmware loading

Details

IR Control Hub provided by Panasonic contains a vulnerability that may lead to loading of unauthorized firmware. IR Control Hub provided by Panasonic verifies the hash value of the loading firmware when booting, but it keeps booting with the firmware even when it detects that the hash value does not match the expected value (CWE-354). Moreover, the product has a UART interface on the board and it is configured active (CWE-1299). When connected directly to this UART interface, the device can be controlled through this interface (CVE-2025-1073). Shravan Singh reported this vulnerability to the developer and coordinated. After the coordination was completed, Shravan Singh and the develpper reported the case to JPCERT/CC to notify users of the solution through JVN.

References

Type

URL

	JVN	https://jvn.jp/en/vu/JVNVU94857368/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-1073
	Missing Protection Mechanism for Alternate Hardware Interface(CWE-1299)	https://cwe.mitre.org/data/definitions/1299.html
	Improper Validation of Integrity Check Value(CWE-354)	https://cwe.mitre.org/data/definitions/354.html

Impacted products

Vendor

Product

Panasonic Corporation

IR Control Hub

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-004863.html",
  "dc:date": "2025-05-14T11:30+09:00",
  "dcterms:issued": "2025-05-14T11:30+09:00",
  "dcterms:modified": "2025-05-14T11:30+09:00",
  "description": "IR Control Hub provided by Panasonic contains a vulnerability that may lead to loading of unauthorized firmware.\r\n\r\nIR Control Hub provided by Panasonic verifies the hash value of the loading firmware when booting, but it keeps booting with the firmware even when it detects that the hash value does not match the expected value (CWE-354).\r\nMoreover, the product has a UART interface on the board and it is configured active (CWE-1299).\r\nWhen connected directly to this UART interface, the device can be controlled through this interface (CVE-2025-1073).\r\n\r\nShravan Singh reported this vulnerability to the developer and coordinated. After the coordination was completed, Shravan Singh and the develpper reported the case to JPCERT/CC to notify users of the solution through JVN.",
  "link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-004863.html",
  "sec:cpe": {
    "#text": "cpe:/o:panasonic:ir_control_hub",
    "@product": "IR Control Hub",
    "@vendor": "Panasonic Corporation",
    "@version": "2.2"
  },
  "sec:identifier": "JVNDB-2025-004863",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU94857368/index.html",
      "@id": "JVNVU#94857368",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-1073",
      "@id": "CVE-2025-1073",
      "@source": "CVE"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/1299.html",
      "@id": "CWE-1299",
      "@title": "Missing Protection Mechanism for Alternate Hardware Interface(CWE-1299)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/354.html",
      "@id": "CWE-354",
      "@title": "Improper Validation of Integrity Check Value(CWE-354)"
    }
  ],
  "title": "Panasonic IR Control Hub vulnerable to Unauthorised firmware loading"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-1073 (GCVE-0-2025-1073)

FKIE_CVE-2025-1073

GHSA-J3FQ-6CWX-WGX7

JVNDB-2025-004863

Tags

Sightings

Nomenclature

Related by attack behaviour