CVE-2025-55976

Executive Summary

CVE-2025-55976 is an unauthenticated information disclosure vulnerability in the Intelbras IWR 3000N wireless router (firmware version 1.9.8). The device's management interface exposes the Wi-Fi passphrase in plaintext through the /api/wireless endpoint, and no authentication is required to retrieve it. Any unauthenticated party with network-level access to the router can obtain the wireless network password, compromising the confidentiality of the Wi-Fi network and the hosts connected to it.

The affected population consists of residential and small-office deployments of the Intelbras IWR 3000N, a device commonly used as a primary gateway and wireless access point. Because the attack requires only a single HTTP GET request and zero privileges, the practical impact is severe: an attacker who obtains the Wi-Fi PSK can join the trusted wireless segment, bypass guest network isolation, and pivot to internal hosts. No public PoC, vendor patch, or CISA KEV listing exists at the time of writing; the vulnerability is currently classified as unpatched.

Technical Analysis

The vulnerability stems from a missing authentication check on a management API endpoint combined with insecurely stored, directly retrievable wireless credentials. According to the NVD description, the Intelbras IWR 3000N firmware version 1.9.8 returns the Wi-Fi password in plaintext when a client queries the /api/wireless endpoint. Two independent security weaknesses contribute to the flaw:

1. Missing authentication (CWE-306) — the endpoint does not require a session cookie, access token, or administrative credentials. The NVD description explicitly states that "any unauthenticated user on the local network" can issue the query. The web server handling the request therefore treats it as authorized by default, with no enforcement of the administrative privilege boundary.

2. Sensitive information exposure (CWE-200) — the response body of /api/wireless contains the wireless network configuration, including the pre-shared key (passphrase), transmitted in cleartext. There is no encryption, redaction, or obfuscation of the credential material in the response.

The attack surface is the router's web management service listening on the local network. In a typical home or small-office topology, the router occupies the network gateway address, and the management interface is reachable from every wired and wireless client on the LAN. Because the request is served without authentication, the exposure is uniform across the network: a device on a guest SSID, a compromised IoT peripheral, or a physical intruder connected to an open port can all retrieve the primary wireless passphrase.

The mechanism is a logic/design flaw in the API layer rather than a memory corruption or injection defect. Exploitation does not require malformed input, payload construction, or bypassing input validation — the legitimate request path itself returns the credential. This makes the vulnerability trivially reliable and highly repeatable. The precise underlying implementation inside the firmware (e.g., how the API handler fetches the wireless configuration from the driver or NVRAM storage) is not disclosed in the available data. Insufficient technical detail is available to describe the internal code path beyond the public endpoint behavior.

From a network perspective, the flaw is reachable at the application layer via HTTP. If remote administration (WAN-side management) is enabled on the device, the exposure could expand beyond the local network; however, the NVD description scopes the attack to local network users, and that scope is used throughout this report.

Exploitation Scenarios

No public exploit code or PoC has been confirmed for CVE-2025-55976. The attack chain below is inferred from the vulnerability class (unauthenticated sensitive-information disclosure via an HTTP API) and the exact endpoint named in the NVD description.

Step 1 — Reconnaissance and target identification. The attacker must be able to reach the router's management interface over HTTP. On a local network, the router is typically identified by its default gateway address (commonly the first or second address of the subnet) or via ARP scanning. The device can be fingerprinted through the HTTP response title or banner, the login page branding ("Intelbras IWR 3000N"), or default administrative interface characteristics. Shodan-style dorks such as http.title:"IWR 3000N" can enumerate exposed devices on the Internet if remote management is enabled.

Step 2 — Triggering the flaw. The attacker sends a single HTTP GET request to the vulnerable endpoint: GET /api/wireless HTTP/1.1 directed at the router's IP address. No cookies, tokens, or authentication headers are required. The request is processed entirely through the device's legitimate code path.

Step 3 — Payload/execution method. There is no payload in the traditional sense. The vulnerability is triggered by the absence of an authentication check, so the "malicious" action is indistinguishable from a legitimate configuration query. The response body returns the wireless network configuration in plaintext, including the SSID and the Wi-Fi passphrase. A simple tool such as curl, wget, or a browser is sufficient to capture the credential material.

Step 4 — Post-exploitation impact. With the PSK in hand, the attacker can:

• Associate to the Wi-Fi network as a legitimate client, bypassing any wireless access control.
• If the passphrase was previously captured via a WPA/WPA2 four-way handshake, decrypt the recorded handshake and any associated traffic without brute-force cracking.
• Conduct ARP spoofing, DNS spoofing, man-in-the-middle interception, or credential harvesting against wireless clients.
• Use the trusted network position to pivot toward wired devices, printers, NAS storage, and other infrastructure.
• Establish persistent presence by retaining the passphrase; the credential remains valid until the SSID passphrase is manually rotated.

It is important to note that exploitation requires no user interaction and no prior compromise. Any device already on the local network — including a guest-network client or an infected IoT device — can reuse this flaw to escalate from an untrusted zone into the primary trusted wireless network.

Impact Assessment

The primary impact of CVE-2025-55976 is a complete loss of confidentiality for the wireless network's shared secret. Because the attack is unauthenticated and requires a single HTTP request, the barrier to exploitation is near zero. The severity is not reflected by an official CVSS score (CVSS: N/A, vector: N/A); however, a reasonable CVSS v3.1 assessment of the flaw would reflect a network-adjacent attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact — resulting in a high-severity rating in practice.

Business impact. In a residential or small-office context, the compromise of the Wi-Fi passphrase erodes the boundary between the public Internet and the internal network. An attacker who joins the Wi-Fi network can intercept traffic of other wireless users (when legacy WEP or WPA-TKIP is in use) or perform active attacks such as DHCP spoofing and rogue AP deployment against connected clients.

Affected systems. Intelbras IWR 3000N devices running firmware 1.9.8. The firmware version is the only confirmed affected version; other releases are unverified given the absence of a vendor disclosure.

Blast radius. The compromise extends beyond the router itself. The exposed credential grants access to every host associated with the Wi-Fi network — computers, mobile devices, printers, smart-home devices, and any guest clients. In a BYOD environment, the passphrase can also be leveraged to impersonate employees on the corporate-adjacent network. If the same password is reused across multiple networks or devices (a common practice in small deployments), the impact propagates to additional systems.

Exploitation likelihood. The EPSS score of 0.03166 places this CVE at the 86.9th percentile of scored vulnerabilities, indicating that while current in-the-wild exploitation is not widespread, the vulnerability ranks relatively high in exploitability compared with the general CVE population. This is consistent with the trivial attack mechanism and the large installed base of consumer-grade networking equipment. The absence of a CISA KEV listing and the lack of known threat-actor campaigns indicate that no confirmed mass exploitation has occurred as of the report date.

Detection Guidance

Detection strategies should focus on (a) network-level inspection of HTTP requests targeting the /api/wireless path, (b) inspection of HTTP responses containing wireless configuration keywords, and (c) router-side web or system logs. The rules below are provided as starting points and should be tuned to local event schemas.

Sigma Rule

title: Intelbras IWR 3000N Wireless PSK Disclosure Attempt
id: 7d3f9c2a-5b2e-4a91-9f0d-3c8e6f1d2a76
status: experimental
description: >
  Detects unauthenticated HTTP GET requests to the /api/wireless endpoint
  on Intelbras IWR 3000N devices, associated with CVE-2025-55976.
  This request returns the Wi-Fi passphrase in plaintext.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-55976
tags:
  - attack.credential_access
  - attack.t1552
  - cve.2025-55976
author: Valtersit Threat Intelligence
date: 2025/06/01
logsource:
  category: webserver
  product: generic
  definition: Web server access logs for the router's management interface
detection:
  selection:
    http.url|contains: /api/wireless
    http.method: GET
  condition: selection
falsepositives:
  - Authorized administrators inspecting wireless settings
  - Network monitoring tools querying device health
level: high

YARA Rule

rule CVE_2025_55976_Intelbras_IWR3000N_PSK_Exposure
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects HTTP responses from Intelbras IWR 3000N containing plaintext Wi-Fi credential material associated with the /api/wireless endpoint"
        reference = "CVE-2025-55976"
        date = "2025-06-01"
        score = 70
    strings:
        $uri = "/api/wireless" ascii wide nocase
        $k_ssid = "ssid" ascii wide nocase
        $k_passphrase = "passphrase" ascii wide nocase
        $k_password = "password" ascii wide nocase
        $k_psk = "psk" ascii wide nocase
        $k_wireless = "wireless" ascii wide nocase
        $k_security = "security" ascii wide nocase
    condition:
        uint16(0) == 0x4854 and            // "HT" from HTTP header
        $uri and
        (2 of ($k_*))
}

Suricata IDS Rule

Two complementary rules: one for the client request, one for the server response.

alert http any any -> any any (msg:"CVE-2025-55976 - Intelbras IWR 3000N /api/wireless PSK disclosure attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/wireless"; nocase; classtype:attempted-recon; sid:202555976; rev:1;)

alert http any any -> any any (msg:"CVE-2025-55976 - Intelbras IWR 3000N Wi-Fi passphrase in HTTP response"; flow:established,to_client; file_data; content:"/api/wireless"; nocase; content:"passphrase"; nocase; content:"ssid"; nocase; classtype:attempted-recon; sid:202555977; rev:1;)

Elastic Detection

EQL query matching the unauthenticated request to the vulnerable endpoint and, where response-body telemetry is available, the leaked credential material:

sequence by source.ip with maxspan=5m
  [ network where network.protocol == "http"
      and http.request.method == "GET"
      and url.path == "/api/wireless" ]
  [ network where network.protocol == "http"
      and (http.response.body contains "passphrase"
           or http.response.body contains "password")
      and url.path == "/api/wireless" ]

Splunk SPL Query

index=* (http_uri="/api/wireless" OR uri="/api/wireless" OR url="/api/wireless")
| stats count min(_time) as first_seen max(_time) as last_seen
        by src_ip, dest_ip, dest_port, http_method, useragent
| where http_method="GET"
| sort - count

For raw packet data (Suricata/Zeek pipelines):

index=network sourcetype=suricata alert.signature="*CVE-2025-55976*"
| stats count by src_ip, dest_ip, alert.signature, http.http_method, http.url
| where http.http_method="GET" AND http.url="/api/wireless"

Wazuh OSSEC Rule

<rule id="895728" level="12">
  <decoded_as>web-access</decoded_as>
  <match>api/wireless</match>
  <description>Possible exploitation of CVE-2025-55976: unauthenticated request to Intelbras IWR 3000N /api/wireless endpoint (Wi-Fi password disclosure)</description>
  <group>webserver, exploit_attempt, cve_2025_55976, credential_access,</group>
  <mitre>
    <id>T1552</id>
  </mitre>
</rule>

Apply the rule to web-access decoders (Apache-compatible access log format) or place it in a custom decoder path if the router exposes syslog output containing HTTP request logs.

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED. No patch, firmware update, or vendor advisory has been identified from any tracked source. Vendor fix: N/A. Workarounds: none provided by the vendor. The following actions should be taken immediately.

1. Immediate mitigations (available today):

• Disable remote/WAN-side management on the router. If the management interface is exposed to the Internet, the attack surface expands beyond the local network.
• Restrict access to the management interface at the network layer. If the router supports firewall rules or access control lists, permit management and the /api/wireless endpoint only from a dedicated administrative host (e.g., a static-IP workstation).
• Rotate the Wi-Fi passphrase immediately if any untrusted party had LAN access or if exposure is suspected. Assume the current PSK is compromised.
• Segment the network: place IoT devices on a separate SSID/VLAN with client isolation enabled, and block guest-network clients from reaching the router's management IP.
• Monitor for anomalous HTTP requests to the /api/wireless path using the detection rules in this report.

2. Patch/upgrade steps:

• No patched firmware is available. Contact Intelbras technical support and request notification of a firmware release addressing CVE-2025-55976.
• Regularly check the vendor's support/download portal for updated firmware for the IWR 3000N.
• If the device reaches end-of-life without a fix, plan for hardware replacement with a model that provides authenticated, restricted management APIs.

3. Long-term hardening:

• Replace the affected device if the vendor does not issue a patch within a reasonable timeframe.
• For new deployments, prefer equipment that supports TLS-encrypted management, role-based access control, and per-endpoint authentication for administrative APIs.
• Adopt network segmentation practices that isolate Wi-Fi clients from gateway management interfaces regardless of vendor.
• Maintain inventory and firmware-version tracking for all edge devices so that newly published CVEs can be correlated with the installed base.
• Consider decommissioning the IWR 3000N device class entirely if forensic evidence of exposure is found, because the plaintext-credential handling suggests deeper architectural weaknesses in the firmware.

References

1. NVD — CVE-2025-55976 detail: https://nvd.nist.gov/vuln/detail/CVE-2025-55976
2. Intelbras — IWR 3000N product information and support portal: https://www.intelbras.com (vendor advisories and firmware downloads; no advisory for this CVE identified as of writing)
3. FIRST EPSS — CVE-2025-55976 score: https://www.first.org/epss/
4. MITRE ATT&CK — Technique T1552, Unsecured Credentials: https://attack.mitre.org/techniques/T1552/
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2025-55976 is not listed)

Known campaigns / exploit-in-the-wild evidence: None identified at the time of writing. No public exploit code, PoC repository, or threat-actor campaign referencing CVE-2025-55976 has been confirmed by the tracked sources. The vulnerability's simplicity, however, makes weaponization straightforward, and the EPSS percentile (86.9%) indicates an elevated likelihood of eventual exploitation.