CVE-2025-43928 is a medium severity path traversal flaw in Infodraw Media Relay Service 7.1.0.0, the web server used with Infodraw surveillance hardware. A crafted username lets a caller read arbitrary files, including a configuration file that may hold administrator credentials. No fixed version is confirmed, so restrict network access to the service.
What's affected
- Product: Infodraw Media Relay Service (MRS) 7.1.0.0, including the PMRS-102 hardware and firmware named in the record.
- Affected: version 7.1.0.0 is named in the record. The researchers who found it say some versions or configurations appear not to be vulnerable.
- Fixed version: not confirmed. The record and the researcher write up do not list one, so contact the vendor and check for a current release.
- Service: the MRS web server listens on port 12654.
- Severity: CVSS 5.8 (medium) in the record.
How to check if you're exposed
You need to know whether the service is running and who can reach it.
# on the MRS host: is anything listening on 12654?
ss -ltnp | grep 12654
# from a network you do not trust: is the port open?
nc -vz your-mrs-host 12654
If the port answers from the internet or from a broad internal range, assume the service is exposed. Also check the installed MRS version in the product's own interface or installer notes, and look at web server logs for unusual usernames that contain directory separators.
A dependency scan will not see this product, so keep it in your asset inventory by hand. For the software you do build, the free in-browser scan at gold.safeguard.sh/scan lists known vulnerable dependencies.
What to do now
- Block port 12654 from the internet and from any network that does not need it. Allow only known operator addresses, or put the service behind a VPN.
- Ask Infodraw for a patched release and the supported upgrade path. Record the answer and the date.
- Treat credentials stored in the MRS configuration file as exposed if the service was reachable. Rotate administrator and operator passwords.
- Review the host for file deletion or unexpected changes, since the researchers also describe arbitrary file deletion through the same weakness.
- If MRS accounts are tied to directory services, check those accounts for unusual sign ins.
Why it matters
The weakness is CWE-22, improper limitation of a pathname to a restricted directory, together with CWE-24, the specific form that uses the ../ sequence. The web server builds a file path from the username field without removing directory sequences, so a username can point outside the intended folder.
The impact is worse than the medium score suggests. According to the Mint Secure write up, the configuration file the bug exposes holds user details and may store the administrator password in cleartext or as an unsalted MD5 hash, which is easy to reverse. A file read becomes a login, and a login on a surveillance relay is a privacy problem for many people. The record does not mark this CVE as a CISA Known Exploited Vulnerability, and none of the sources I fetched report exploitation.
Quick check
Is a fixed version available?
It is not confirmed in the record or the researcher write up. Ask the vendor and check for a release newer than 7.1.0.0.
What is the fastest safe step?
Take port 12654 off the internet and restrict it to known addresses, then rotate the credentials the service stores.
Sources
Last reviewed: 18 October 2026.
