CVE-2025-34119 - CVE House
Back to Database
Status published High CVE-2025-34119

EasyCafe Server 2.2.14 Remote File Disclosure via Opcode 0x43

Vulnerability Description

A remote file disclosure vulnerability exists in EasyCafe Server 2.2.14, exploitable by unauthenticated remote attackers via TCP port 831. The server listens for a custom protocol where opcode 0x43 can be used to request arbitrary files by absolute path. If the file exists and is accessible, its content is returned without authentication. This flaw allows attackers to retrieve sensitive files such as system configuration, password files, or application data.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-34119

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • R-73eN

References

Affected Vendor

Affected Software

EasyCafe Server
Vulnerable Versions:
2.2.14

Timeline

Official Publish: July 16th, 2025
Last Modified: April 7th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-668 CWE-306

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1078 Valid Accounts
Persistence
T1136 Create Account
Persistence
T1098 Account Manipulation
Privilege Escalation
T1021 Remote Services
Lateral Movement