Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2025-4384

Certificate validity not properly verified

Medium6.0EPSS 0.13%
Published
Updated
Reserved
Assigned by
arcinfo

Description

The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet become valid. This allows malicious devices to present certificates that are not rejected properly. The use of a client certificate reduces the risk for random devices to take advantage of this flaw.

Scores

CVSS scores of CVE-2025-4384, by who scored it
Scored byCVSSScoreVector
arcinfoCNA (assigner)4.0Medium6.0CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/AU:N/R:U/RE:M/U:Green
NVDNVD · Deferred4.0Medium6.0CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:M/U:Green
EPSS (exploitation in 30 days)
0.13% · top 97% of all CVEs (6 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.0.

Weakness

Affected products

  • arcinfo · PcVue

    • unaffected 16.3.0
    • affected 16.0 – < 16.2.5
    • affected 15.0 – < 15.2.12

What to do

Solution: Harden the configuration Who should apply this recommendation: All users The system operators are highly recommended to take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should: * Use client certificate when configuring the MQTT add-on. * Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet unless required. * Locate control system networks and remote devices behind firewalls and isolate them from business networks. * When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices. Update PcVue Who should apply this recommendation: All users using the affected component Apply the patch by installing a fixed PcVue version. Available patches: Fixed in: * PcVue 16.2.5 and PcVue 16.3.0 * PcVue 15.2.12

Exploitation: No POC available.

Exploitation: Not known to be exploited.

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2025-4384 badge
[![CVE-2025-4384](https://trackcve.app/badge/CVE-2025-4384.svg)](https://trackcve.app/cve/CVE-2025-4384)

Record last updated .