Security readout for executives and security teams
Plain-English summary
CVE-2025-66963 is a medium-severity information disclosure issue reported in Hitron HI3120 firmware v.7.2.4.5.2b1. A local, low-privileged attacker may obtain sensitive information through logout behavior in index.html. Business urgency is moderate because confidentiality impact is high, but the attacker must already have local access and some privileges.
Executive priority
Prioritize identification and containment over emergency response. The issue can expose sensitive information, but current sources indicate local access requirements and no confirmed active exploitation. Escalate priority if affected devices manage critical connectivity or are reachable by untrusted local users.
Technical view
The CVE describes CWE-200 exposure in Hitron HI3120 v.7.2.4.5.2b1 involving the Logout option in index.html. CVSS 3.1 is 5.5: local attack vector, low complexity, low privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. Structured affected metadata is incomplete in the source bundle.
Likely exposure
Exposure appears limited to environments with Hitron HI3120 devices running v.7.2.4.5.2b1, especially where local users can reach the device web interface. The source bundle does not provide CPEs, deployment scope, or vendor-maintained affected-version data.
Exploitation context
The provided CVE data does not show CISA KEV listing or evidence of active exploitation. The described attacker position is local with low privileges. Public details are sparse, so treat exploitation feasibility as source-limited rather than proven widespread.
Researcher notes
The strongest evidence is the CVE record, CVSS vector, and a single public researcher reference. Affected metadata is marked n/a, so product/version conclusions rely on the title and description. No patch details, exploit-in-the-wild evidence, or vendor advisory are present in the provided bundle.
Mitigation direction
- Check Hitron or operator guidance for firmware updates or official workarounds.
- Restrict local access to the device management interface.
- Segment management access from untrusted local networks.
- Review device configuration for unnecessary web interface exposure.
- Replace or upgrade affected firmware if vendor remediation is available.
Validation and detection
- Inventory Hitron HI3120 devices and record firmware versions.
- Confirm whether any device runs v.7.2.4.5.2b1.
- Review vendor or service-provider advisories for this model.
- In a lab, verify logout behavior does not expose sensitive information.
- Check local network controls around device administration access.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-200: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-66963 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/kakarotossj3/CVEs/blob/main/Hitron/Insufficient%20Session%20Expiration/DetailsCVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.