BaseFortify

Publication date: 2025-11-06

Last updated on: 2025-11-12

Assigner: Red Hat, Inc.

Description

A flaw was found in Rubygem MQTT. By default, the package used to not have hostname validation, resulting in possible Man-in-the-Middle (MITM) attack.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-06

Last Modified

2025-11-12

Generated

2026-07-06

AI Q&A

2025-11-06

EPSS Evaluated

2026-07-05

NVD

CVE-2025-12790

Affected Vendors & Products

Vendor	Product	Version / Range
rubygems	mqtt	3.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-29	The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a flaw in the Rubygem MQTT package where, by default, hostname validation is not performed. This lack of validation can allow an attacker to perform a Man-in-the-Middle (MITM) attack by intercepting and potentially altering the communication between the client and the MQTT server.

Impact Analysis

The vulnerability can impact you by exposing your MQTT communications to Man-in-the-Middle (MITM) attacks. This means an attacker could intercept, read, or modify the data being transmitted, leading to potential loss of confidentiality and integrity of your information.

Hi! I’m here to help you understand CVE-2025-12790. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70