CVE Catalog
CVE-2025-62772
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk0.16%
4th percentile - higher than 4% of all known CVEs
Summary
On Mercku M6a devices through version 2.1.0, session tokens remain valid for at least months in some cases.
Risk Assessment
Long-lived session tokens increase the risk of session hijacking by an attacker, who could gain unauthorized access to the device and data.
Recommendation
It is recommended to update the device firmware to a newer version that implements shorter session token lifetimes, and to enforce regular logouts.
Other vulnerabilities in Mercku M6a
See allOriginal NVD description (English source)
On Mercku M6a devices through 2.1.0, session tokens remain valid for at least months in some cases.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS