CVE-2025-63207: Rvr TEX1002LCD Firmware

Critical severity, CVSS 9.8. EPSS: 7% chance of exploitation in the next 30 days.

The R.V.R Elettronica TEX product (firmware TEXL-000400, Web GUI TLAN-000400) is vulnerable to broken access control due to improper authentication checks on the /_Passwd.html endpoint. An attacker can send an unauthenticated POST request to change the Admin, Operator, and User passwords, resulting in complete system compromise.

Affected products

• Rvr TEX1002LCD Firmware: version texl-000400 only
• Rvr TEX100LCD/S Firmware: version texl-000400 only
• Rvr TEX150LCD/S Firmware: version texl-000400 only
• Rvr TEX2000LIGHT Firmware: version texl-000400 only
• Rvr TEX2500LCD Firmware: version texl-000400 only
• Rvr TEX300LCD Firmware: version texl-000400 only
• Rvr TEX30LCD/S Firmware: version texl-000400 only
• Rvr TEX3500LCD Firmware: version texl-000400 only
• Rvr TEX502LCD Firmware: version texl-000400 only
• Rvr TEX50LCD/S Firmware: version texl-000400 only
• Rvr TEX702LCD Firmware: version texl-000400 only

Published 2025-11-19. Last modified 2026-06-17.