CVE-2025-63209: The ELCA Star Transmitter Remote Control firmware 1.25 for STAR150, BP1000, STAR300, STAR2000, STAR1000, STAR5
46
This week
HIGH 7.5REMOTEMITIGATEMITIGATEMITIGATE
CVE-2025-63209 is a high-severity flaw (CVSS 7.5) affecting star150 firmware, bp1000 firmware, star300 firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The ELCA Star Transmitter Remote Control firmware 1.25 for STAR150, BP1000, STAR300, STAR2000, STAR1000, STAR500, and possibly other models, contains an information disclosure vulnerability allowing unauthenticated attackers to retrieve admin credentials and system settings via an unprotected /setup.xml endpoint. The admin password is stored in plaintext under the <p05> XML tag, potentially leading to remote compromise of the transmitter system.
Why this priority
High severity
Public exploit reference
Remotely exploitable, no login, no user action
No fix is published yet: follow the downgrade or mitigation steps.
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
Published CVE record published
Updated Record last modified
elcaradio star150 firmware MITIGATE
Affected: 1.25
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.25
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
elcaradio bp1000 firmware MITIGATE
Affected: 1.25
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.25
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
elcaradio star300 firmware MITIGATE
Affected: 1.25
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.25
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
elcaradio star2000 firmware MITIGATE
Affected: 1.25
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.25
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
elcaradio star1000 firmware MITIGATE
Affected: 1.25
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.25
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
elcaradio star500 firmware MITIGATE
Affected: 1.25
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.25
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
Verify at the official sourceNVD · CVE Program · Report a problem with this page Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-63209?
star150 firmware: mitigate or apply the listed mitigation; bp1000 firmware: mitigate or apply the listed mitigation; star300 firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2025-63209 being exploited?
CVE-2025-63209 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-63209 affect?
CVE-2025-63209 affects star150 firmware, bp1000 firmware, star300 firmware. Severity is high (CVSS 7.5). The ELCA Star Transmitter Remote Control firmware 1.25 for STAR150, BP1000, STAR300, STAR2000, STAR1000, STAR500, and possibly other models, contains an information disclosure vulnerability allowing unauthenticated attackers to retrieve adm
How urgent is CVE-2025-63209?
Priority 46/100. High severity; Public exploit reference; Remotely exploitable, no login, no user action
PatchTheCVE