CVE-2025-5124 - CVE House
Back to Database
Status published Critical CVE-2025-5124

Sony SNC-M1 Administrative Interface default credentials

Vulnerability Description

A vulnerability classified as critical has been found in Sony SNC-M1, SNC-M3, SNC-RZ25N, SNC-RZ30N, SNC-DS10, SNC-CS3N and SNC-RX570N up to 1.30. This affects an unknown part of the component Administrative Interface. The manipulation leads to use of default credentials. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. It is recommended to change the configuration settings. The vendor was contacted early about this issue. They confirmed the existence but pointed out that they "have published the 'Hardening Guide' on the Web from July 2018 to January 2025 and have thoroughly informed customers of the recommendation to change their initial passwords".

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-5124

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • zeke (VulDB User)

References

More from Sony

View All →
CVE-2025-64390
A privilege escalation vulnerability exists in PlayStation 4 firmware versions...
Unknown 0
CVE-2025-5820
Sony XAV-AX8500 Bluetooth ERTM Channel Authentication Bypass Vulnerability
Medium 6.3
CVE-2025-5479
Sony XAV-AX8500 Bluetooth AVCTP Protocol Heap-based Buffer Overflow Remote Code Execution Vulnerability
High 7.5
CVE-2025-5478
Sony XAV-AX8500 Bluetooth SDP Protocol Integer Overflow Remote Code Execution Vulnerability
High 8.8
CVE-2025-5477
Sony XAV-AX8500 Bluetooth L2CAP Protocol Heap-based Buffer Overflow Remote Code Execution Vulnerability
High 7.5

Affected Vendor

Affected Software

SNC-M1, SNC-M3, SNC-RZ25N, SNC-RZ30N, SNC-DS10, SNC-CS3N, SNC-RX570N
Vulnerable Versions:
1.0, 1.1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12, 1.13, 1.14, 1.15, 1.16, 1.17, 1.18, 1.19, 1.20, 1.21, 1.22, 1.23, 1.24, 1.25, 1.26, 1.27, 1.28, 1.29, 1.30

Timeline

Official Publish: May 24th, 2025
Last Modified: May 28th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-1392

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.