CVE-2018-25130

Beward Intercom 2.3.1 Local Credentials Disclosure via Unencrypted Database

Medium6.8EPSS 0.15%

Published: 24 Dec 2025
Updated: 24 Dec 2025
Reserved: 24 Dec 2025
Assigned by: VulnCheck

Description

Beward Intercom 2.3.1 contains a credentials disclosure vulnerability that allows local attackers to access plain-text authentication credentials stored in an unencrypted database file. Attackers can read the BEWARD.INTERCOM.FDB file to extract usernames and passwords, enabling unauthorized access to IP cameras and door stations.

Scores

CVSS scores of CVE-2018-25130, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	Medium6.8	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
VulnCheckCNA (assigner)	3.1	Medium6.2	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVDNVD · Deferred	4.0	Medium6.8	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.15% · top 96% of all CVEs (5 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.8.

Weakness

CWE-256: Plaintext Storage of a Password (opens in a new tab)All about CWE-256 and its CVEs

Affected products

Beward R&D Co., Ltd · BEWARD Intercom
- affected 2.3.1.34471
- affected 2.3.0
- affected 2.2.11
- affected 2.2.10.5
- affected 2.2.9
- affected 2.2.8.9
- affected 2.2.7.4

References (3)

ExploitDB-46267 (opens in a new tab)exploit
Beward Product Homepage (opens in a new tab)product
Zero Science Lab Disclosure (ZSL-2019-5505) (opens in a new tab)third-party-advisoryexploit

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2018-25130](https://trackcve.app/badge/CVE-2018-25130.svg)](https://trackcve.app/cve/CVE-2018-25130)

Record last updated 24 Dec 2025, 20:27 UTC.