Vulnerability details
CVE-2025-7426
MINOVA Information Services TTA
MINOVA TTA Information Disclosure and Credential Exposure
CVSS 4.0
9.3Critical
Official description
Information disclosure and exposure of authentication FTP credentials over the debug port 1604 in the MINOVA TTA service. This allows unauthenticated remote access to an active FTP account containing sensitive internal data and import structures. In environments where this FTP server is part of automated business processes (e.g. EDI or data integration), this could lead to data manipulation, extraction, or abuse. Debug ports 1602, 1603 and 1636 also expose service architecture information and system activity logs
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.3Critical | 4.0 | CVEProject cvelistV5 (CNA) (NCSC.ch) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:H/SI:H/SA:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| MINOVA Information Services GmbH | TTA | 11.17.0 | CVEProject cvelistV5 (CNA) |
References and advisories
2- https://www.minova.de/de/tta.html product
- https://www.cryptron.ch/en/blog-detail/security-advisory-CVE-2025-7426-en.html technical-descriptionthird-party-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-08-25
- Last updated
- 2025-08-25
- State
- Published
- Assigner (CNA)
- NCSC.ch
Exploit prediction (EPSS)
0.28%
Probability of exploitation in 30 days
20.8%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Proof of concept
- Technical impact
- Total
Weaknesses (CWE)
- CWE-200Exposure of Sensitive Information to an Unauthorized Actor
- CWE-312Cleartext Storage of Sensitive Information
- CWE-532Insertion of Sensitive Information into Log File