PT-2025-34811

CVE-2025-55443

Published

2025-02-03

Updated

2025-08-27

Description by

CVSS 3.1

9.1

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Telpo MDM versions 1.4.6 through 1.4.9

Description: The Telpo MDM Android platform stores sensitive administrator credentials and MQTT server connection details (IP/port) in plaintext within log files on the device's external storage. This allows attackers with access to these logs to authenticate to the MDM web platform and execute administrative operations, including device shutdown, factory reset, and software installation. Additionally, attackers can connect to the MQTT server to intercept or publish device data.

Recommendations: Update to a newer version of Telpo MDM that addresses this issue.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CWE-352: Cross-Site Request Forgery (CSRF)

CWE-312: Cleartext Storage of Sensitive Information

CWE-532: Insertion of Sensitive Information into Log File