CVE-2025-3329 - CVE House
Back to Database
Status published Low CVE-2025-3329

Consumer Comanda Mobile Restaurant Order cleartext transmission

Vulnerability Description

A vulnerability classified as problematic has been found in Consumer Comanda Mobile up to 14.9.3.2/15.0.0.8. This affects an unknown part of the component Restaurant Order Handler. The manipulation of the argument Login/Password leads to cleartext transmission of sensitive information. The attack can only be initiated within the local network. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-3329

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • davimo (VulDB User)

References

Affected Vendor

Affected Software

Comanda Mobile
Vulnerable Versions:
14.9.3.0, 14.9.3.1, 14.9.3.2, 15.0.0.0, 15.0.0.1, 15.0.0.2, 15.0.0.3, 15.0.0.4, 15.0.0.5, 15.0.0.6, 15.0.0.7, 15.0.0.8

Timeline

Official Publish: April 7th, 2025
Last Modified: April 7th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-319 CWE-310

MITRE ATT&CK TTPs

T1040 Network Sniffing
Collection
T1557 Adversary-in-the-Middle
Credential Access
T1552 Unsecured Credentials
Credential Access
T1078 Valid Accounts
Persistence
T1071 Application Layer Protocol
Command and Control