{"data":{"id":"81c23dfe-effc-448f-bfb2-9d4fa0f08684","title":"CVE-2025-10772: A vulnerability was identified in huggingface LeRobot up to 0.3.3. Affected by this vulnerability is an unknown…","summary":"CVE-2025-10772 affects huggingface LeRobot up to 0.3.3. The flaw sits in lerobot/common/robot_devices/robots/lekiwi_remote.py, within the ZeroMQ Socket Handler component, where a manipulation leads to missing authentication (CWE-287, CWE-306). The attack can only be launched from within the local network, and the vendor did not respond to early disclosure.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-10772","publishedAt":"2025-09-22T04:15:39.410Z","cveId":"CVE-2025-10772","cweIds":["CWE-287","CWE-306"],"cvssScore":"6.3","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["HuggingFace"],"affectedVendorsRaw":["HuggingFace LeRobot"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"huggingface LeRobot missing authentication in ZeroMQ socket handler","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00291,"epssCheckedAt":"2026-11-04T12:08:33.690Z","kevDateAdded":null,"advisoryAliases":["GHSA-472g-659m-76xf"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-04T12:08:47.487Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-114","CAPEC-115"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}