SNC-M1: Use of Default Credentials
CVE-2025-5124 is a high-severity use of default credentials vulnerability in SNC-M1 from Sony, with a CVSS 3.1 base score of 8.1 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected SNC-M1 versions: 1.0; 1.1; 1.2, and others listed below. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 1.02% chance of exploitation within 30 days, higher than 64% of scored CVEs.
High severity with no evidence of exploitation so far.
What to do
- Check which version of SNC-M1 you run against the affected versions below, and install the vendor's latest release.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Sony | SNC-M1 | 1.0; 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 1.7; and 23 more ranges | Not stated |
| Sony | SNC-M3 | 1.0; 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 1.7; and 23 more ranges | Not stated |
| Sony | SNC-RZ25N | 1.0; 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 1.7; and 23 more ranges | Not stated |
| Sony | SNC-RZ30N | 1.0; 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 1.7; and 23 more ranges | Not stated |
| Sony | SNC-DS10 | 1.0; 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 1.7; and 23 more ranges | Not stated |
| Sony | SNC-CS3N | 1.0; 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 1.7; and 23 more ranges | Not stated |
| Sony | SNC-RX570N | 1.0; 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 1.7; and 23 more ranges | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- HighSuccess depends on conditions outside the attacker's control.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA (vuldb.com).
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 4.0 | 9.2 | Critical | CNA (vuldb.com) |
| CVSS 3.1 | 8.1 | High | CNA (vuldb.com) |
| CVSS 2.0 | 7.6 | High | CNA (vuldb.com) |
Official description
A vulnerability classified as critical has been found in Sony SNC-M1, SNC-M3, SNC-RZ25N, SNC-RZ30N, SNC-DS10, SNC-CS3N and SNC-RX570N up to 1.30. This affects an unknown part of the component Administrative Interface. The manipulation leads to use of default credentials. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. It is recommended to change the configuration settings. The vendor was contacted early about this issue. They confirmed the existence but pointed out that they "have published the 'Hardening Guide' on the Web from July 2018 to January 2025 and have thoroughly informed customers of the recommendation to change their initial passwords".
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use of Default Credentials
The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.
How developers prevent this class of flaw
- Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.
- Force the administrator to change the credential upon installation.
- The product administrator could change the defaults upon installation or during operation.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: poc, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Other references
Recent Use of Default Credentials vulnerabilities
- 7.1 High severity
- 9.8 Critical severity
- 7.2 High severity
- 7.5 High severity
- 7.6 High severity
- 7.5 High severity
Spotted an error? Tell us.