{"id":86586,"date":"2026-03-02T03:29:56","date_gmt":"2026-03-02T03:29:56","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T06:00:00","slug":"cve-2025-52492-hard-coded-credentials-vulnerability-in-paxton-paxton10-firmware","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-52492-hard-coded-credentials-vulnerability-in-paxton-paxton10-firmware\/","title":{"rendered":"CVE-2025-52492: Hard-Coded Credentials Vulnerability in Paxton Paxton10 Firmware<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

This report discusses CVE-2025-52492, a critical vulnerability discovered in the firmware of Paxton Paxton10 versions prior to 4.6 SR6. This vulnerability is of significant concern as it could potentially lead to unauthorized access, information disclosure, and disruption of services. The vulnerability lies in the hard-coded credentials for the Twilio API found in the firmware file, rootfs.tar.gz.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-52492
\nSeverity: High (7.5 CVSS Score)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: Unauthorized access, information disclosure, potential service disruption, and unauthorized use of Twilio services.<\/p>\n

Affected Products<\/strong><\/p>

\r\n

\r\n \r\n \"Ameeba\r\n <\/a>\r\n Share secrets securely\r\n <\/h2>\r\n\r\n

\r\n Ameeba is private infrastructure for communication and sensitive work built on encrypted identity instead of exposed corporate identity systems.\r\n <\/p>\r\n\r\n

\r\n Passwords, credentials, confidential files, screenshots, internal discussions, sensitive AI context, and private coordination should not become exposed across ordinary communication platforms.\r\n <\/p>\r\n\r\n