CVE•Published 2025-12-12•Modified 2026-10-07•0 articles on news•5 live references•NVD data

CVE-2025-36755

Vulnerability data via NVD (ingested)

CVSS v3.1

—

EPSS percentile

Exploit Prediction Scoring System · top 94% of all CVEs

Weaknesses (CWE)

CWE-1191On-Chip Debug and Test Interface With Improper Access Control CWE-1244Internal Asset Exposed to Unsafe Debug Access Level or State

Description

The CleverDisplay BlueOne hardware player is designed with its USB interfaces physically enclosed and inaccessible under normal operating conditions. Researchers demonstrated that, after cicumventing the device’s protective enclosure, it was possible to connect a USB keyboard and press ESC during boot to access the BIOS setup interface. BIOS settings could be viewed but not modified. This behavior slightly increases the attack surface by exposing internal system information (CWE-1244) once the enclosure is removed, but does not allow integrity or availability compromise under standard or tested configurations.

Timeline

Published 2025-12-12

Modified 2026-10-07

External references

NVD MITRE Exploit-DB GitHub PoC VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag0 hosts

vuln:CVE-2025-36755

Hosts Shodan has explicitly fingerprinted as vulnerable.

More intel sources (5)

Shodan report

vuln:CVE-2025-36755

Country / ASN / product breakdown for the vuln query.

Censys

vulnerabilities.cve_id: CVE-2025-36755

Censys host search filtered to this CVE id.

grep.app

CVE-2025-36755