CVE-2025-4384

The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet become valid. This allows malicious devices to present certificates that are not rejected properly. The use of a client certificate reduces the risk for random devices to take advantage of this flaw.

Score

CVSS 4.0 6.0 Medium

Status

Deferred - 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932

Published

2025-05-06

Last modified

2025-09-05

Weaknesses

CWE-298

Affected products

• Pcvue (Arcinfo)

References

• https://www.pcvue.com/security/#SB2025-3