External risk intelligence

Dataphone A920 Vulnerability Allows Unauthenticated Functionality Trigger

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2025-61235

The device is a Dataphone A920, a point-of-sale terminal. While network-reachable, these devices are typically deployed within private, segmented payment networks behind firewalls or gateways. Although they interact with network services, they are not standard public-facing web or API endpoints in common deployments, making internet-wide exposure possible but not the standard architectural pattern.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in Dataphone A920 devices that could allow unauthorized access and functionality execution due to insufficient validation of custom network packets. This could potentially impact the integrity and availability of the device's operations.

Custom data packets can bypass security controls.
Confirms unauthorized access to device functions.
Assess device relevance and exposure in your network.

Attack Path

How an attacker could exploit the issue

An attacker can send a specially crafted network packet to a vulnerable Dataphone A920 device. Because the device does not properly check the contents of certain fields within this packet, it accepts the malicious data without requiring any authentication. This can lead to the device triggering unintended functionality.

Requires network access to the device.
Triggered by sending an unauthenticated, custom packet.
Risk includes unauthorized function execution.

Live Threat

Current exploitation, exposure, and threat context

A vulnerability in the Dataphone A920 could allow an unauthenticated user to trigger device functionality by sending a specially crafted packet that bypasses normal validation checks. This could affect device operations when the device is accessible over a network.

Device functionality.
Unauthenticated network access.
Disruption of service operations.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Dataphone A920 could impact device availability and data confidentiality. Identifying all deployed Dataphone A920 units, confirming their network exposure and business criticality, and assigning ownership are the crucial first steps before planning remediation.

Device owners should lead remediation efforts.
Verify network reachability and business impact.
Plan phased updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Dataphone A920?

The Dataphone A920 is a point-of-sale terminal used for processing payment transactions. These devices are typically managed hardware units designed to handle sensitive payment data within secure retail or hospitality environments, serving as a gateway between customer transactions and backend financial networks.

What does CVE-2025-61235 mean?

This CVE represents a vulnerability classified as CWE-20, or Improper Input Validation. In simple terms, the device fails to check the quality or legitimacy of data it receives. Because it does not verify the content of incoming network packets, it can be tricked into running internal functions even when the commands provided are trivial, garbage, or malicious.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specifically crafted network packet to the device. The device will not trigger this behavior if the incoming packet adheres to expected standards, as it only occurs when the device accepts malformed, unauthenticated data that it should have rejected. Standard, valid traffic does not activate this unintended functionality.

Is my Dataphone A920 at risk?

Halo Surface Signal notes that while these devices are network-reachable, they are typically isolated within private or segmented payment networks. Your risk level depends on your specific architecture; devices placed directly on the open internet are at higher risk than those hidden behind secure firewalls, gateways, or dedicated payment VLANs.

What steps should I take if I use these devices?

Begin by creating an inventory of all Dataphone A920 units in your environment. Once you have identified them, evaluate their network placement to confirm if they are exposed to untrusted segments. Work with your IT or security team to restrict network access to these devices, ensuring they are only reachable by authorized systems while you prepare for maintenance.

References

github.com/stuxve/poc-dataphone-crafted-packet

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.