---
id: CVE-2025-64305
title: >-
  MicroServer copies parts of the system firmware to an unencrypted external SD
  card on boot, which contains user and vendor secrets
summary: >-
  MicroServer copies parts of the system firmware to an unencrypted external SD
  card on boot, which contains user and vendor secrets. An attacker can utilize
  these plaintext secrets to modify the vendor firmware, or gain admin access to
  th…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-313
published: '2026-01-07'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T23:10:00.237'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-64305'
references:
  - url: >-
      https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-006-01.json
    label: ics-cert@hq.dhs.gov
  - url: 'https://www.cisa.gov/news-events/ics-advisories/icsa-26-006-01'
    label: ics-cert@hq.dhs.gov
tags:
  - nvd
epss: 0.00136
epssPercentile: 0.02512
ingestedAt: '2026-09-30T23:29:32.557Z'
---

## Overview

MicroServer copies parts of the system firmware to an unencrypted external SD card on boot, which contains user and vendor secrets. An attacker can utilize these plaintext secrets to modify the vendor firmware, or gain admin access to the web portal.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.