Security readout for executives and security teams
Plain-English summary
CVE-2025-10464 concerns Birtech Senseway/Sensaway storing sensitive information, including passwords, insecurely in cleartext. A low-privileged user with network access may be able to retrieve embedded sensitive data. The manufacturer reportedly cannot fix the issue because the product uses outdated technology and advises users to contact them and review newer products.
Executive priority
Prioritize identification and vendor engagement. This is not described as actively exploited, but it creates confidentiality risk and may have no direct patch path. Plan for replacement or compensating controls if the product remains in use.
Technical view
The CVE maps to CWE-312 and CWE-922: cleartext and insecure storage of sensitive information. CVSS 3.1 is 6.5, with network attack vector, low complexity, low privileges required, no user interaction, and high confidentiality impact. Integrity and availability impacts are not identified in the source bundle.
Likely exposure
Organizations using Birtech Senseway/Sensaway through 09022026 should assume potential exposure. The affected-version data is sparse and inconsistent, so asset owners should confirm product name, version, and deployment status directly with vendor or advisory sources.
Exploitation context
No KEV listing or provided source indicates active exploitation. The CVSS vector suggests exploitation requires network access and a low-privileged account, but could expose stored sensitive data if reachable.
Researcher notes
Evidence is limited. The CVE text uses both Senseway and Sensaway, and the affected version field is unclear. One referenced government URL is marked broken in the bundle. Avoid assuming broader product impact beyond the named Birtech application.
Mitigation direction
- Contact the manufacturer for current guidance and replacement options.
- Review updated products developed with newer technology, as advised by the disclosure.
- Inventory Senseway/Sensaway deployments and owners.
- Limit access to the application to authorized users and trusted networks.
- If credentials are confirmed exposed, follow internal credential-rotation procedures.
Validation and detection
- Confirm whether Senseway/Sensaway is deployed in your environment.
- Verify version and support status with Birtech or official advisories.
- Review access paths for low-privileged users reaching the application.
- Check whether sensitive data or passwords are stored in cleartext.
- Document exposed credentials and affected business processes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-312: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-922: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-10464 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N2.83.6TR-CERTVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.usom.gov.tr/bildirim/tr-26-0022CVE reference, TR-CERT · government-resource, broken-link
- https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0022CVE reference, TR-CERT · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Cleartext Storage of Sensitive Information
Cleartext Storage of Sensitive Information represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Insecure Storage of Sensitive Information
Insecure Storage of Sensitive Information represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.