CVE-2025-49162

Executive Summary

CVE-2025-49162 is a critical file overwrite vulnerability affecting Arris VIP1113 devices running KreaTV SDK, disclosed as of 2025-05-30. The flaw resides in the TFTP (Trivial File Transfer Protocol) implementation, where a remote attacker can inject a space character in the filename to control the local file path on the device. This allows arbitrary file overwrite, potentially leading to firmware corruption, denial of service, or code execution if critical system files are replaced. With a CVSS score of 6.4 (Medium), the vulnerability is network-exploitable without authentication, but requires low attack complexity. No official patch has been released, and the EPSS score is 0.0%, indicating low active exploitation in the wild. However, given the public nature of the vulnerability and the lack of mitigations, immediate defensive measures are recommended.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in embedded devices (Arris VIP1113 set-top boxes). Supply chain risk is limited to the device manufacturer and firmware distribution channels.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): None (N) – No data disclosure.
• Integrity (I): High (H) – Arbitrary file overwrite can corrupt system files.
• Availability (A): None (N) – No direct denial of service, but file corruption may cause device failure.

Threat Level: Medium. The vulnerability allows file overwrite, which can be leveraged for persistent compromise or device bricking. No authentication is required, making it attractive for botnet recruitment or targeted attacks.

Deep Dive & Mechanics

The vulnerability exists in the TFTP server component of the KreaTV SDK running on Arris VIP1113 devices. TFTP is a simple file transfer protocol that does not support authentication or directory traversal protection. The flaw specifically involves how the server handles filenames containing space characters.

Root Cause: The TFTP server does not sanitize or validate the remote filename provided by the client. When a filename contains a space character (e.g., ../../etc/passwd ), the server incorrectly parses the filename, allowing the attacker to control the local file path. This is a classic path traversal combined with filename injection.

Attack Flow:

1. Attacker sends a TFTP write request (WRQ) with a crafted filename containing a space and path traversal sequences.
2. The server interprets the space as a delimiter or fails to properly escape it, resulting in the file being written to an attacker-controlled location.
3. The attacker can overwrite critical system files (e.g., /etc/shadow, /bin/busybox, firmware update scripts) to gain code execution or cause denial of service.

Example Payload:

tftp> put malicious_file "../../tmp/evil_script.sh "

The trailing space causes the server to write to /tmp/evil_script.sh instead of the intended directory.

Vulnerable vs. Patched Code

No patched code is available. The vulnerable code is in the TFTP server implementation of KreaTV SDK. A hypothetical fix would involve:

• Vulnerable: fopen(filename, "w") where filename is directly taken from the TFTP request without sanitization.
• Patched: fopen(sanitized_filename, "w") where sanitized_filename is validated against path traversal patterns and space characters are rejected or escaped.

Since no patch exists, the only mitigation is to disable TFTP or restrict network access.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Arris VIP1113 device with KreaTV SDK (firmware version up to 2025-05-30).
• Network access to the device's TFTP port (default UDP 69).
• A TFTP client (e.g., tftp command-line tool).

Exploitation Steps:

1. Identify the target device using Shodan dork: "Arris VIP1113" "TFTP open".
2. Prepare a malicious file (e.g., a modified firmware script or a reverse shell binary).
3. Send a TFTP write request with a crafted filename:

   tftp 192.168.1.100
   tftp> mode binary
   tftp> put malicious_file "../../tmp/evil.sh "
   

4. The file is written to /tmp/evil.sh on the device.
5. If the file is executable and triggered (e.g., via cron or reboot), code execution is achieved.

Note: The trailing space is critical. Without it, the file may be written to the default TFTP directory.

Blue Team

Detection:

• Monitor TFTP traffic for filenames containing spaces or path traversal sequences (../, ..\\).
• Alert on TFTP write requests to unusual paths (e.g., /tmp, /etc, /bin).
• Use network intrusion detection systems (NIDS) to flag anomalous TFTP activity.

Hunting:

• Search for files with unexpected names or locations on the device.
• Check for unauthorized modifications to system binaries or configuration files.
• Review TFTP server logs for suspicious filenames.

Mitigation:

• Block TFTP traffic (UDP 69) at the network perimeter.
• If TFTP is required, restrict access to trusted IPs only.
• Implement file integrity monitoring (FIM) on critical system files.
• Consider upgrading to a patched firmware version if available.

Indicators of Compromise (IOCs)

• Network:
  • TFTP write requests with filenames containing spaces or path traversal sequences.
  • Outbound TFTP traffic from the device to unknown IPs (exfiltration of modified files).
• File System:
  • Unexpected files in /tmp, /etc, /bin, or /var directories.
  • Modified system binaries (e.g., busybox, init, dropbear).
  • Presence of files with trailing spaces in their names.
• Process:
  • Unusual processes spawned from /tmp or other writable directories.
  • TFTP server process (tftpd) with abnormal behavior.

Detection Engineering

YARA Rule

rule CVE_2025_49162_TFTP_File_Overwrite {
    meta:
        description = "Detects TFTP filenames with spaces or path traversal indicating CVE-2025-49162 exploitation"
        author = "Valters IT"
        date = "2025-05-30"
        reference = "CVE-2025-49162"
    strings:
        $space = " " ascii
        $path_traversal = "../" ascii
        $path_traversal2 = "..\\" ascii
    condition:
        // Match on TFTP WRQ packets (opcode 2) with suspicious filenames
        uint16(0) == 2 and
        (
            for any of ($space, $path_traversal, $path_traversal2) : (
                # in (0..filesize)
            )
        )
}

Sigma Rule

title: CVE-2025-49162 TFTP File Overwrite Attempt
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6d
status: experimental
description: Detects TFTP write requests with filenames containing spaces or path traversal sequences
author: Valters IT
date: 2025-05-30
logsource:
    category: network
    product: suricata
detection:
    selection:
        app_proto: tftp
        tftp.opcode: 'WRQ'
        tftp.filename|contains:
            - ' '
            - '../'
            - '..\\'
    condition: selection
falsepositives:
    - Legitimate use of spaces in filenames (rare in embedded systems)
level: high

Suricata Rule

alert udp any any -> any 69 (msg:"CVE-2025-49162 TFTP File Overwrite Attempt"; content:"|00 02|"; depth:2; content:"|20|"; within:100; reference:cve,2025-49162; classtype:attempted-admin; sid:1000001; rev:1;)

Note: The rule matches TFTP WRQ packets (opcode 0x0002) containing a space character (0x20) in the filename.

Remediation & Mitigation

1. Immediate: Disable TFTP service on Arris VIP1113 devices if not required. Use firewall rules to block UDP port 69 from untrusted networks.
2. Short-term: If TFTP is necessary, restrict access to specific IP addresses using ACLs. Monitor TFTP logs for suspicious filenames.
3. Long-term: Contact Arris for a firmware patch. If no patch is available, consider replacing the device with a supported alternative.
4. Compensating Controls: Implement file integrity monitoring (e.g., Tripwire, AIDE) on critical system files. Use network segmentation to isolate vulnerable devices.
5. Detection: Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert