How severe is CVE-2025-1073?

CVE-2025-1073 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over physical access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability low.

Is CVE-2025-1073 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (9th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2025-1073?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2025-1073 have an EU (EUVD) identifier?

Yes. CVE-2025-1073 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-10675.

When was CVE-2025-1073 published?

CVE-2025-1073 was published on 2025-04-10 and last updated on 2026-06-17.

CVE-2025-1073

CVE-2025-1073 is a high-severity vulnerability with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1299.

Key facts

Severity: High (CVSS 3.x base score 7.5)
EPSS exploit prediction: 0% (9th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-10675
Weakness: CWE-1299
Published: 2025-04-10
Last modified: 2026-06-17

Description

Panasonic IR Control Hub (IR Blaster) versions 1.17 and earlier may allow an attacker with physical access to load unauthorized firmware onto the device.

Frequently asked questions

What is CVE-2025-1073?: Panasonic IR Control Hub (IR Blaster) versions 1.17 and earlier may allow an attacker with physical access to load unauthorized firmware onto the device.
How severe is CVE-2025-1073?: CVE-2025-1073 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over physical access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability low.
Is CVE-2025-1073 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (9th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2025-1073?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2025-1073 have an EU (EUVD) identifier?: Yes. CVE-2025-1073 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-10675.
When was CVE-2025-1073 published?: CVE-2025-1073 was published on 2025-04-10 and last updated on 2026-06-17.

References

https://lsin.panasonic.com/release-notes

Other CWE-1299 vulnerabilities

CVE-2025-35998 — High (CVSS 7.9): Missing protection mechanism for alternate hardware interface in the Intel(R) Quick Assist Technology for some Intel(R)…
CVE-2025-41697 — Medium (CVSS 6.8): An attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g. with the…
CVE-2024-47944 — Medium (CVSS 6.8): The device directly executes .patch firmware upgrade files on a USB stick without any prior authentication in the admin…

Browse all CWE-1299 vulnerabilities →