BaseFortify

Publication date: 2025-09-30

Last updated on: 2025-10-02

Assigner: ICS-CERT

Description

Keysight Ixia Vision has an issue with hardcoded cryptographic material which may allow an attacker to intercept or decrypt payloads sent to the device via API calls or user authentication if the end user does not replace the TLS certificate that shipped with the device. Remediation is available in Version 6.9.1, released on September 23, 2025.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-09-30

Last Modified

2025-10-02

Generated

2026-07-06

AI Q&A

2025-10-01

EPSS Evaluated

2026-07-05

NVD

CVE-2025-24525

Affected Vendors & Products

Vendor	Product	Version / Range
keysight	ixia_vision	6.9.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-321	The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

Executive Summary

This vulnerability in Keysight Ixia Vision involves hardcoded cryptographic material. If the end user does not replace the TLS certificate that ships with the device, an attacker may be able to intercept or decrypt data sent to the device via API calls or user authentication.

Impact Analysis

The vulnerability can allow an attacker to intercept or decrypt sensitive information transmitted to the device, potentially compromising confidentiality of API calls and user authentication data.

Mitigation Strategies

To mitigate this vulnerability, immediately replace the TLS certificate that shipped with the Keysight Ixia Vision device with a new, secure certificate. Additionally, upgrade the device firmware to Version 6.9.1 or later, which contains the remediation for this issue.

Hi! I’m here to help you understand CVE-2025-24525. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70