CVE-2025-10285

Executive Summary

CVE-2025-10285 exposes a critical information disclosure vulnerability in the Silicon Labs Simplicity Device Manager web interface. The interface is publicly accessible without authentication, allowing an attacker to extract NTLMv2 hashes. These hashes can be cracked offline to recover domain passwords, leading to potential lateral movement and privilege escalation within an Active Directory environment. The vulnerability has a CVSS score of 0.0 in the NVD data, but this is likely a placeholder; the actual risk is high due to the ease of exploitation and the sensitivity of the exposed data.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary hardware management tool from Silicon Labs. Supply chain risk is limited to the distribution of the Simplicity Device Manager software itself, which should be obtained only from official Silicon Labs channels.

CVSS Breakdown & Threat Level

The NVD CVSS score is listed as 0.0, which is likely an error or placeholder. Based on the vulnerability description, a more realistic assessment would be:

• Attack Vector (AV): Network (N) – The web interface is exposed publicly.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Changed (C) – The compromised hash can be used to attack other systems (domain).
• Confidentiality (C): High (H) – NTLMv2 hashes can be cracked to reveal passwords.
• Integrity (I): None (N) – No direct data modification.
• Availability (A): None (N) – No direct denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Estimated Base Score: 8.6 (High)

Threat Level: High. The vulnerability allows unauthenticated extraction of credentials that can be used for lateral movement.

Deep Dive & Mechanics

The Silicon Labs Simplicity Device Manager is a web-based management interface for Silicon Labs devices. The vulnerability lies in the web server's handling of authentication requests. When a client attempts to access a protected resource, the server responds with a 401 Unauthorized status and includes a WWW-Authenticate: Negotiate header. This triggers the client to perform NTLM authentication, which sends an NTLMv2 hash of the user's password to the server.

In a normal scenario, the server would validate this hash against a domain controller. However, in this vulnerable implementation, the server simply logs or echoes the hash back to the attacker without any validation. The attacker can capture this hash by:

1. Sending a request to any protected endpoint (e.g., /login, /config).
2. Receiving the 401 response with the WWW-Authenticate: Negotiate header.
3. The client (e.g., a browser or tool like curl) automatically sends the NTLMv2 hash.
4. The server returns the hash in the response body or logs it, which the attacker can retrieve.

The NTLMv2 hash can then be cracked offline using tools like hashcat or john to recover the plaintext password. If the password is weak, it can be cracked quickly. The attacker can then use the recovered password to access other domain resources.

Vulnerable vs. Patched Code

No patched code is available. The vulnerable code is likely in the web server's authentication handler. A simplified example of the vulnerable behavior:

Vulnerable (Python-like pseudocode):

def handle_request(request):
    if not is_authenticated(request):
        response = HttpResponse(401)
        response.headers['WWW-Authenticate'] = 'Negotiate'
        # Vulnerable: logs the NTLM hash from the request
        log_to_file(request.headers.get('Authorization'))
        return response
    else:
        # Serve the resource
        pass

Patched (Expected behavior):

def handle_request(request):
    if not is_authenticated(request):
        response = HttpResponse(401)
        response.headers['WWW-Authenticate'] = 'Negotiate'
        # Do NOT log or expose the NTLM hash
        return response
    else:
        # Serve the resource
        pass

The patch should remove any logging or echoing of the Authorization header that contains the NTLM hash. Additionally, the server should not respond with the hash in the body.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running Silicon Labs Simplicity Device Manager with the web interface exposed.
• A tool to capture the NTLMv2 hash (e.g., curl, Responder, or a custom script).

Steps:

1. Identify the target: Use Shodan or manual scanning to find devices with the Simplicity Device Manager interface.

2. Trigger NTLM authentication: Use curl with the --ntlm flag to force NTLM authentication and capture the hash.

   curl -v --ntlm --user "anyuser:anypassword" http://target-ip/protected-endpoint 2>&1 | grep -i "ntlm\|negotiate"
   

   Alternatively, use a tool like ntlmrelayx from Impacket to capture the hash:

   ntlmrelayx.py -t http://target-ip/protected-endpoint -smb2support
   

3. Crack the hash: Use hashcat to crack the captured NTLMv2 hash.

   hashcat -m 5600 captured_hash.txt wordlist.txt --force
   

Example Output:

$ curl -v --ntlm --user "test:test" http://192.168.1.100/login 2>&1
*   Trying 192.168.1.100:80...
* Connected to 192.168.1.100 (192.168.1.100) port 80 (#0)
* Server auth using NTLM with user 'test'
> GET /login HTTP/1.1
> Host: 192.168.1.100
> Authorization: NTLM TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA=
>
< HTTP/1.1 401 Unauthorized
< WWW-Authenticate: NTLM TlRMTVNTUAACAAAABgAGADgAAAAFgokCAAAAAAAAAAAAAAAAAAAAAAA=
<
* Connection #0 to host 192.168.1.100 left intact

The hash is exchanged in the Authorization and WWW-Authenticate headers. An attacker can capture the full NTLMv2 hash from the client's response.

Blue Team (Defense & Detection)

Detection:

• Monitor for 401 Unauthorized responses followed by NTLM authentication attempts from external IPs.
• Look for repeated Authorization: NTLM headers in logs.
• Use the Sigma rule below to detect NTLM authentication attempts to the Simplicity Device Manager.

Mitigation:

• Restrict access to the web interface to trusted IPs only (firewall rules).
• Disable NTLM authentication on the device if not required.
• Apply network segmentation to isolate the device from the internet.
• Monitor for unusual outbound traffic from the device.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with Authorization: NTLM headers to the Simplicity Device Manager.
  • 401 Unauthorized responses with WWW-Authenticate: NTLM headers.
  • Outbound connections from the device to unknown IPs (potential hash exfiltration).
• File IOCs:
  • Log files containing NTLM hashes (e.g., ntlm_hash_*.log).
• System IOCs:
  • Unauthorized access to the device's web interface from external IPs.

Detection Engineering

YARA Rule

rule Detect_NTLM_Hash_Exposure {
    meta:
        description = "Detects NTLMv2 hashes in log files or network captures"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-10285"
    strings:
        $ntlm_hash = /TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA=/
        $ntlm_auth = "Authorization: NTLM"
        $www_auth = "WWW-Authenticate: NTLM"
    condition:
        any of them
}

Sigma Rule

title: NTLM Authentication to Simplicity Device Manager
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects NTLM authentication attempts to the Silicon Labs Simplicity Device Manager web interface.
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/login'
        sc-status: 401
        cs(User-Agent): '*'
    condition: selection
falsepositives:
    - Legitimate administrative access
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-10285 - NTLM Hash Extraction Attempt"; flow:to_server; content:"Authorization|3a| NTLM"; http_header; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Network Access: Place the Simplicity Device Manager behind a firewall and allow access only from trusted IP addresses.
2. Disable NTLM: If possible, disable NTLM authentication on the device and use a more secure method (e.g., Kerberos, certificate-based).
3. Monitor Logs: Review web server logs for any unauthorized NTLM authentication attempts.

Long-Term Fix:

• Apply a firmware/software update from Silicon Labs when available.
• Implement proper authentication that does not expose NTLM hashes.
• Conduct a security audit of the device's web interface.

Workaround:

• Use a reverse proxy (e.g., Nginx) to add authentication before requests reach the device.

Valters IT
Securing Digital Frontiers