CVE-2019-25436: Sricam Deviceviewer

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Sricam DeviceViewer 3.12.0.1 contains a password change security bypass vulnerability that allows authenticated users to change passwords without proper validation of the old password field. Attackers can inject a large payload into the old password parameter during the change password process to bypass validation and set an arbitrary new password.

Affected products

• Sricam Deviceviewer: version 3.12.0.1 only

Published 2026-02-20. Last modified 2026-06-17.