CVE-2025-62772

Executive Summary

CVE-2025-62772 exposes a critical session management flaw in Mercku M6a devices running firmware versions up to 2.1.0. The vulnerability allows session tokens to remain valid for extended periods—potentially months—without expiration. This lack of session revocation enables an attacker who obtains a valid token (e.g., via network sniffing, cross-site scripting, or physical access) to maintain persistent, unauthorized access to the device's administrative interface. The CVSS score of 3.1 reflects the low complexity of exploitation but limited direct impact; however, in combination with other weaknesses, this can lead to full device compromise. No public proof-of-concept or patch is currently available, making this a high-priority monitoring and mitigation target for defenders.

CVSS Breakdown & Threat Level

• CVSS Score: 3.1 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Network – the vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – no authentication needed to initiate the attack.
• User Interaction (UI): None – no user action required.
• Scope (S): Unchanged – exploitation does not affect other components.
• Confidentiality (C): Low – limited information disclosure (session tokens).
• Integrity (I): None – no data modification.
• Availability (A): None – no denial of service.

Threat Level: Low (CVSS 3.1) but elevated in real-world scenarios due to token persistence. An attacker with a valid token can maintain access indefinitely, potentially leading to lateral movement or data exfiltration.

Deep Dive & Mechanics

The vulnerability stems from improper session token expiration handling in the Mercku M6a web interface. The device does not enforce a maximum token lifetime or implement token revocation upon logout. Session tokens are generated at login and stored without a timestamp or expiry check. This means that once a token is issued, it remains valid until the device is rebooted or the token is manually invalidated (which is not a standard feature). Attackers can capture tokens via:

• Network sniffing (if HTTPS is not enforced or if the token is transmitted in cleartext).
• Cross-site scripting (XSS) on the admin interface.
• Physical access to the device's storage.

The token is typically a random string stored in a cookie (e.g., sessionid). The server validates the token against a static database without checking creation time. This design flaw allows token reuse for months.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Pseudocode for session validation in Mercku M6a firmware <= 2.1.0
def validate_session(token):
    # No expiry check
    if token in session_store:
        return True
    return False

Patched Code (Hypothetical):

# Patched version with expiry enforcement
import time
SESSION_TIMEOUT = 3600  # 1 hour

def validate_session(token):
    if token in session_store:
        session_data = session_store[token]
        if time.time() - session_data['created_at'] < SESSION_TIMEOUT:
            return True
        else:
            # Remove expired token
            del session_store[token]
    return False

The patched version introduces a timestamp check and automatic token invalidation after a configurable timeout.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Environment:

• Target: Mercku M6a device with firmware 2.1.0 (or earlier)
• Attacker: Kali Linux with curl, Burp Suite, or custom Python script

Steps:

1. Obtain a valid session token (e.g., via network capture or XSS).
2. Use the token to access admin endpoints without re-authentication:

   curl -X GET http://192.168.1.1/admin/config \
        -H "Cookie: sessionid=CAPTURED_TOKEN"
   

3. Maintain access for months without re-authentication.

No public exploit code is available. The above demonstrates the core attack vector.

Blue Team (Defense & Detection)

Mitigation Steps:

1. Enforce HTTPS to prevent token sniffing.
2. Implement token expiry (e.g., 1 hour) and refresh mechanism.
3. Add logout functionality that invalidates tokens server-side.
4. Monitor for anomalous session usage (e.g., same token from different IPs).

Detection Rules: See Detection Engineering section.

Indicators of Compromise (IOCs)

• Session Token Persistence: A token that remains valid for >24 hours without user activity.
• Multiple IPs using same token: Indicates token theft.
• Unusual admin interface access times: e.g., 3 AM from unknown IP.
• Network traffic: HTTP requests with Cookie: sessionid=<token> to /admin/* endpoints.

File-based IOCs (if physical access):

• /tmp/session_store or similar file containing token data without timestamps.

Detection Engineering

YARA Rule

rule Mercku_Session_Token_Persistence {
    meta:
        description = "Detects session token files without expiry timestamps in Mercku M6a firmware"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-62772"
    strings:
        $token_pattern = /sessionid=[a-f0-9]{32}/  // Example token format
        $no_expiry = "expires" nocase
    condition:
        $token_pattern and not $no_expiry
}

Sigma Rule

title: Mercku M6a Session Token Reuse Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects multiple authentication attempts using the same session token from different source IPs
author: Valters IT
logsource:
    category: web
    product: mercku_m6a
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/admin/*'
        cs-cookie: 'sessionid=*'
    condition: selection
    timeframe: 1h
    aggregation:
        field: cs-cookie
        function: distinct_count(c-ip)
        condition: gt 2
falsepositives:
    - Legitimate proxy usage
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-62772 Mercku M6a Session Token Reuse";
    flow:to_server,established;
    content:"Cookie|3a| sessionid="; nocase;
    http_cookie;
    sid:1000001;
    rev:1;
    reference:cve,2025-62772;
    classtype:attempted-recon;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade firmware to a patched version (if/when available). Contact Mercku support for updates.
2. Manually enforce session timeout by rebooting the device periodically (e.g., daily cron job).
3. Disable remote admin access if not required.
4. Use a VPN to access the admin interface.

Long-term Fixes:

• Implement proper session management with expiry and revocation.
• Add logging for all admin actions.
• Conduct a security audit of the web interface.

Workarounds:

• Place the device behind a firewall with strict ACLs.
• Monitor logs for token reuse anomalies.

Valters IT