CVE-2025-70342 - Vulnerability Analysis
MediumCVSS: 6.6Last Updated: March 4, 2026
erase-install - Authentication Bypass
Published: March 4, 2026Updated: March 4, 2026PoC Available
Overview
erase-install prior to v40.4 contains a credential disclosure caused by writing swiftDialog credential output to a hardcoded path /var/tmp/dialog.json, letting unauthenticated attackers intercept admin credentials via named pipe creation.
Severity & Score
Severity: Medium
CVSS Score: 6.6
Impact
Unauthenticated attackers can intercept admin credentials during reinstall/erase operations, leading to credential compromise.
Mitigation
Update to version v40.4 or later.
References
Related Resources
Details
- CVE ID
- CVE-2025-70342
- Severity
- Medium
- CVSS Score
- 6.6
- Type
- broken_authentication
- Status
- new
CWE
- CWE-732
CVSS Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N