{"vulnerability": "cve-2025-25305", "sightings": [{"uuid": "5af13b99-6203-4b21-a712-f1823c38d24c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25305", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lihxx2p4ei2k", "content": "", "creation_timestamp": "2025-02-18T19:16:24.642350Z"}, {"uuid": "d71ed33d-93e0-4120-b624-782712663ce4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2025-25305", "type": "published-proof-of-concept", "source": "https://github.com/home-assistant/core/security/advisories/GHSA-m3pm-rpgg-5wj6", "content": "", "creation_timestamp": "2025-02-18T15:20:00.000000Z"}, {"uuid": "0fe44fe9-1d60-4be7-ba55-ac13b37c65f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25305", "type": "seen", "source": "https://t.me/cvedetector/18337", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-25305 - Home Assistant Core SSL Verification Bypass\", \n  \"Content\": \"CVE ID : CVE-2025-25305 \nPublished : Feb. 18, 2025, 7:15 p.m. | 39\u00a0minutes ago \nDescription : Home Assistant Core is an open source home automation that puts local control and privacy first. Affected versions are subject to a potential man-in-the-middle attacks due to missing SSL certificate verification in the project codebase and used third-party libraries. In the past, `aiohttp-session`/`request` had the parameter `verify_ssl` to control SSL certificate verification. This was a boolean value. In `aiohttp` 3.0, this parameter was deprecated in favor of the `ssl` parameter. Only when `ssl` is set to `None` or provided with a correct configured SSL context the standard SSL certificate verification will happen. When migrating integrations in Home Assistant and libraries used by Home Assistant, in some cases the `verify_ssl` parameter value was just moved to the new `ssl` parameter. This resulted in these integrations and 3rd party libraries using `request.ssl = True`, which unintentionally turned off SSL certificate verification and opened up a man-in-the-middle attack vector. This issue has been addressed in version 2024.1.6 and all users are advised to upgrade. There are no known workarounds for this vulnerability. \nSeverity: 7.0 | HIGH \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"18 Feb 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-02-18T20:59:32.000000Z"}, {"uuid": "1375cae1-af5c-4411-96c8-cb545d988aaf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-25305", "type": "published-proof-of-concept", "source": "Telegram/2uxF_1qoFB3hlCxfLn3xIrN9O42tmrJDZ5kGfls8NVGPMqg", "content": "", "creation_timestamp": "2025-02-18T20:31:23.000000Z"}]}