Description
An information disclosure vulnerability exists in Aquatronica Controller System firmware versions <= 5.1.6 and web interface versions <= 2.0. The tcp.php endpoint fails to restrict unauthenticated access, allowing remote attackers to issue crafted POST requests and retrieve sensitive configuration data, including plaintext administrative credentials. Exploitation of this flaw can lead to full compromise of the system, enabling unauthorized manipulation of connected devices and aquarium parameters.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Aquatronica | Aquatronica Controller System | ≤ 5.1.6 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Aquatronica Controller System <= 5.1.6 - Information Disclosure http/cves/2025/CVE-2025-25037.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5824.php exploit third-party-advisory
- https://www.exploit-db.com/exploits/52028 exploit third-party-advisory
- https://fortiguard.fortinet.com/encyclopedia/ips/56008 third-party-advisory
- https://www.aquatronica.com product
- https://vulncheck.com/advisories/aquatronica-controller-system-credential-leak third-party-advisory