CVE-2025-24525

Keysight Ixia Vision has an issue with hardcoded cryptographic material which may allow an attacker to intercept or decrypt payloads sent to the device via API calls or user authentication if the end user does not replace the TLS certificate that shipped with the device. Remediation is available in Version 6.9.1, released on September 23, 2025.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.ixiacom.com/
https://support.ixiacom.com/support-overview/product-support/downloads-updates
https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-02
https://www.keysight.com/us/en/contact.html

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) Keysight Ixia Vision tiene un problema con material criptográfico codificado de forma rígida que podría permitir a un atacante interceptar o descifrar cargas útiles enviadas al dispositivo a través de llamadas a la API o la autenticación de usuario si el usuario final no reemplaza el certificado TLS que se envió con el dispositivo. La remediación está disponible en la versión 6.9.1, lanzada el 23 de septiembre de 2025.

30 Sep 2025, 23:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-09-30 23:15

Updated : 2026-04-15 00:35

NVD link : CVE-2025-24525

Mitre link : CVE-2025-24525

CVE.ORG link : CVE-2025-24525

JSON object : View

Products Affected

No product.

CWE

CWE-321

Use of Hard-coded Cryptographic Key

{"id": "CVE-2025-24525", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-09-30T23:15:27.970", "references": [{"url": "https://support.ixiacom.com/", "source": "ics-cert@hq.dhs.gov"}, {"url": "https://support.ixiacom.com/support-overview/product-support/downloads-updates", "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-063-02", "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.keysight.com/us/en/contact.html", "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-321"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-321"}]}], "descriptions": [{"lang": "en", "value": "Keysight Ixia Vision has an issue with hardcoded cryptographic material \nwhich may allow an attacker to intercept or decrypt payloads sent to the\n device via API calls or user authentication if the end user does not \nreplace the TLS certificate that shipped with the device. Remediation is\n available in Version 6.9.1, released on September 23, 2025."}, {"lang": "es", "value": "Keysight Ixia Vision tiene un problema con material criptogr\u00e1fico codificado de forma r\u00edgida que podr\u00eda permitir a un atacante interceptar o descifrar cargas \u00fatiles enviadas al dispositivo a trav\u00e9s de llamadas a la API o la autenticaci\u00f3n de usuario si el usuario final no reemplaza el certificado TLS que se envi\u00f3 con el dispositivo. La remediaci\u00f3n est\u00e1 disponible en la versi\u00f3n 6.9.1, lanzada el 23 de septiembre de 2025."}], "lastModified": "2026-04-15T00:35:42.020", "sourceIdentifier": "ics-cert@hq.dhs.gov"}