CVE-2025-3927

9.8 criticalEPSS 0.6%

Critical (9.8) in digigram pyko-out. EPSS 0.6% chance of exploitation in the next 30 days.

Digigram's PYKO-OUT audio-over-IP (AoIP) web-server does not require a password by default, allowing any attacker with the target IP address to connect and compromise the device, potentially pivoting to connected network or hardware devices.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
CWE: CWE-862
Published: 2025-05-02
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

digigram:pyko-out

References

https://www.digigram.com/download/pyko-out-user-manual-en-jan-2019/
https://www.kb.cert.org/vuls/id/360686

Check your stack JSON