CVE-2025-44018

Executive Summary

CVE-2025-44018 is a critical firmware downgrade vulnerability affecting the GL-Inet GL-AXT1800 router running firmware version 4.7.0. The flaw resides in the OTA (Over-The-Air) Update functionality, where a specially crafted .tar file can be used to downgrade the device to an older, vulnerable firmware version. This attack requires a Man-in-the-Middle (MitM) position between the router and its update server, allowing an attacker to intercept and replace legitimate update packages with malicious ones. The vulnerability has a CVSS score of 8.3 (High), indicating significant potential for complete compromise of device integrity and confidentiality. No public exploit code or proof-of-concept is currently available, and no patch has been released by the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 8.3 (High)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – The attack is performed over the network.
• Attack Complexity (AC): High – The attacker must achieve a Man-in-the-Middle position, which requires additional steps (e.g., ARP spoofing, DNS poisoning, or compromising a network gateway).
• Privileges Required (PR): None – No authentication is needed to trigger the vulnerability.
• User Interaction (UI): None – The victim does not need to perform any action beyond normal OTA update checks.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Downgraded firmware may expose sensitive data or allow data exfiltration.
• Integrity (I): High – The attacker can replace the firmware with a malicious version.
• Availability (A): High – The attacker could render the device inoperable or unstable.

Threat Level: High. The attack requires a MitM position, but once achieved, the impact is severe. The lack of a patch and the widespread use of GL-Inet routers in home and small office environments increases the risk.

Deep Dive & Mechanics

The vulnerability is rooted in the OTA update mechanism of the GL-AXT1800 router. The device periodically checks for firmware updates by connecting to a remote server and downloading a .tar file containing the new firmware. The flaw lies in the lack of proper cryptographic verification of the downloaded package. Specifically:

1. No Signature Verification: The router does not validate a digital signature on the .tar file before applying the update. This allows an attacker to replace the legitimate update with a crafted one.
2. No Version Rollback Protection: The update process does not check whether the new firmware version is higher than the current one. This enables a downgrade attack, where the attacker can install an older, vulnerable firmware version.
3. MitM Exploitation: An attacker on the same network (or controlling a compromised upstream router) can intercept the OTA update request and respond with a malicious .tar file. This can be done using tools like mitmproxy, Ettercap, or Bettercap.

The crafted .tar file contains a modified firmware image that may include backdoors, altered configuration, or other malicious code. Once applied, the router reboots into the compromised firmware, giving the attacker persistent access.

Vulnerable vs. Patched Code

Since no patch is available, a comparison is not possible. However, the vulnerable code likely resides in the OTA update handler (e.g., a script or binary that processes the .tar file). A secure implementation would include:

• Digital Signature Verification: Using RSA or ECDSA to verify the package's authenticity.
• Version Check: Ensuring the new firmware version is greater than the current one.
• Checksum Validation: Verifying the integrity of the downloaded file using a hash (e.g., SHA-256) from a trusted source.

Vulnerable Code (Conceptual):

#!/bin/sh
# OTA update script (simplified)
wget http://update.gl-inet.com/firmware/latest.tar -O /tmp/update.tar
tar -xf /tmp/update.tar -C /tmp/firmware
flashcp /tmp/firmware/image.bin /dev/mtdblock0
reboot

Patched Code (Conceptual):

#!/bin/sh
# OTA update script with verification
wget https://update.gl-inet.com/firmware/latest.tar -O /tmp/update.tar
wget https://update.gl-inet.com/firmware/latest.tar.sig -O /tmp/update.sig
# Verify signature using public key
openssl dgst -sha256 -verify /etc/gl-inet/public.pem -signature /tmp/update.sig /tmp/update.tar
if [ $? -ne 0 ]; then
    echo "Signature verification failed"
    exit 1
fi
# Check version
current_version=$(cat /etc/version)
new_version=$(tar -xf /tmp/update.tar -O version.txt)
if [ "$new_version" -le "$current_version" ]; then
    echo "Downgrade not allowed"
    exit 1
fi
tar -xf /tmp/update.tar -C /tmp/firmware
flashcp /tmp/firmware/image.bin /dev/mtdblock0
reboot

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A GL-AXT1800 router running firmware 4.7.0.
• A machine on the same network as the router (or control over an upstream router).
• Tools: mitmproxy, Bettercap, or Ettercap for MitM; tar and dd for crafting the malicious firmware.

Steps:

1. Set up MitM:

   # Using Bettercap to ARP spoof the router
   sudo bettercap -eval "set arp.spoof.targets 192.168.1.1; arp.spoof on"
   

2. Intercept OTA Update Request:

   • Configure mitmproxy to intercept HTTP/HTTPS traffic.
   • Redirect the router's update request to a local server.

3. Craft Malicious Firmware:

   • Obtain an older, vulnerable firmware version (e.g., 4.6.0).
   • Modify the firmware image to include a backdoor (e.g., add a reverse shell script).
   • Create a .tar file with the modified image:

     tar -cvf malicious_update.tar firmware.bin
     

4. Serve Malicious Update:

   • Host the .tar file on a local web server.
   • Use mitmproxy to replace the legitimate update response with the malicious one.

5. Trigger Update:

   • Wait for the router to check for updates, or force an update via the web interface.

Expected Outcome: The router reboots with the older, compromised firmware, granting the attacker persistent access.

Blue Team (Defense & Detection)

Detection:

• Monitor for unexpected ARP replies or DNS spoofing attempts on the network.
• Log all OTA update attempts and verify the source IP of the update server.
• Use network intrusion detection systems (NIDS) to detect MitM tools (e.g., Bettercap signatures).

Prevention:

• Disable automatic OTA updates until a patch is available.
• Manually verify firmware updates by downloading from the official GL-Inet website and checking checksums.
• Use a VPN or encrypted tunnel for all router management traffic.
• Implement network segmentation to isolate IoT devices.

Indicators of Compromise (IOCs)

• Network:
  • Unexpected ARP replies (e.g., multiple MAC addresses for the same IP).
  • DNS responses pointing to non-official update servers.
  • HTTP/HTTPS traffic to suspicious IPs on port 80/443 during update times.
• File:
  • Presence of a .tar file in /tmp/ with unexpected content.
  • Modified firmware image with embedded scripts (e.g., /etc/init.d/backdoor).
• System:
  • Router firmware version downgraded unexpectedly.
  • New processes running as root (e.g., reverse shell connections).
  • Unusual outbound connections from the router to unknown IPs.

Detection Engineering

YARA Rule

rule CVE_2025_44018_GL_AXT1800_Downgrade {
    meta:
        description = "Detects malicious .tar files used for firmware downgrade on GL-AXT1800"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-44018"
    strings:
        $tar_magic = { 75 73 74 61 72 } // "ustar" magic bytes
        $firmware_header = "GL-AXT1800" nocase
        $version_string = /version:\s*4\.\d+\.\d+/ nocase
    condition:
        $tar_magic at 0 and $firmware_header and $version_string
}

Sigma Rule

title: GL-AXT1800 Firmware Downgrade Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects network traffic indicative of a firmware downgrade attack on GL-AXT1800
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_ip: "192.168.1.1"  # Router IP (adjust as needed)
        dest_port: 80
        http.host: "update.gl-inet.com"
        http.url: "/firmware/latest.tar"
    condition: selection
falsepositives:
    - Legitimate OTA updates from official server
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"CVE-2025-44018 GL-AXT1800 Firmware Downgrade Attempt"; flow:to_server; content:"GET"; http_method; content:"/firmware/latest.tar"; http_uri; content:"update.gl-inet.com"; http_host; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Automatic OTA Updates: Turn off the automatic update feature in the router's web interface.
2. Manual Updates Only: Download firmware updates directly from the official GL-Inet website and verify checksums before applying.
3. Network Segmentation: Place the router on a separate VLAN or subnet to limit exposure.
4. Monitor Network Traffic: Use NIDS to detect MitM attacks and suspicious update requests.

Long-Term Fix:

• Vendor Patch: GL-Inet must release a firmware update that includes cryptographic signature verification and version rollback protection.
• User Education: Inform users about the risks of MitM attacks and the importance of secure update practices.

Workaround:

• Use a VPN to encrypt all traffic between the router and the update server, preventing MitM interception.

Valters IT