CVE-2025-49087 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	4 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
mitre	CNA	4 MEDIUM				CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
CISA-ADP	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 15%

Vendor	Product	Version
arm	mbed_tls	3.6.1 ≤ 𝑥 < 3.6.4

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

mbedtls

bullseye	2.16.9-0.1 not-affected
bookworm	2.28.3-1 not-affected
bullseye (security)	2.16.9-0.1+deb11u3 fixed
forky	3.6.4-2 fixed
sid	3.6.4-2 fixed
trixie	3.6.4-2 fixed

Known Exploits!

https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-5.md

Common Weakness Enumeration

CWE-385 - Covert Timing Channel
Covert timing channels convey information by modulating some aspect of system behavior over time, so that the program receiving the information can observe system behavior and infer protected information.

References

https://github.com/Mbed-TLS/mbedtls-docs/blob/main/security-advisories/mbedtls-security-advisory-2025-06-5.md

https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/