CVE-2025-43928

CVE-2025-43928 is a critical directory traversal vulnerability affecting Infodraw Media Relay Service (MRS) 7.1.0.0 and related products (pmrs_102, pmrs_102_firmware). An unauthenticated attacker can exploit this flaw by manipulating the username field on the MRS web server (port 12654) to read arbitrary files, including ServerParameters.xml which may contain cleartext or MD5-hashed administrator credentials. This vulnerability carries a CVSS score of 9.8 (Critical), indicating a severe risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. The EPSS score is low, suggesting a low probability of exploitation in the wild, but the FAUCET Risk Score is 95/100. While there is no known active exploitation, exploit code (Metasploit, Nuclei, ExploitDB) is not publicly available, and it is not listed in the CISA KEV catalog, there is significant community discussion surrounding this CVE, including a recent presentation on the vulnerability and the challenges in vendor remediation.