CVE-2025-67115

Executive Summary

CVE-2025-67115 is a path traversal vulnerability discovered in the Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware. The flaw resides in the /ftl/web/setup.cgi endpoint, where the log_type parameter is not properly sanitized. This allows a remote authenticated attacker to read arbitrary files from the device filesystem by sending crafted values to /logsave.htm. The vulnerability affects firmware versions before DG3934v3@2308041842. No official patch has been confirmed, and no public exploit code or Nuclei template is available at this time. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for exposed devices.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored)
• Vector: UNKNOWN
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Authenticated)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None
• Threat Level: Medium (due to authenticated requirement but high impact on confidentiality)

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) flaw in the CGI script /ftl/web/setup.cgi. The script handles requests to /logsave.htm and uses the log_type parameter to construct file paths for log retrieval. Without proper input validation, an attacker can inject ../ sequences to escape the intended log directory and read arbitrary files, such as /etc/passwd, configuration files, or SSH keys.

Root Cause: The application fails to sanitize or canonicalize the log_type parameter before using it in file system operations. This allows traversal outside the intended directory.

Attack Flow:

1. Authenticate to the device (e.g., via default credentials or session hijacking).
2. Send a GET request to /logsave.htm with a crafted log_type parameter, e.g., ../../etc/passwd.
3. The server reads the requested file and returns its contents in the response.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Pseudocode for vulnerable CGI
char log_path[256];
snprintf(log_path, sizeof(log_path), "/var/log/%s", get_param("log_type"));
FILE *fp = fopen(log_path, "r");
if (fp) {
    // Send file contents to client
}

Patched Code (Conceptual):

// Pseudocode for patched CGI
char log_path[256];
char *log_type = get_param("log_type");
// Sanitize: remove path traversal sequences
if (strstr(log_type, "..") != NULL || strchr(log_type, '/') != NULL) {
    return_error("Invalid log type");
}
snprintf(log_path, sizeof(log_path), "/var/log/%s", log_type);
// Also use realpath() to resolve symlinks
char resolved[256];
if (realpath(log_path, resolved) == NULL || strncmp(resolved, "/var/log/", 9) != 0) {
    return_error("Access denied");
}
FILE *fp = fopen(resolved, "r");

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a vulnerable Sercomm SCE4255W device (firmware < DG3934v3@2308041842).
• Valid credentials (default: admin/admin or similar).

Exploit Steps:

1. Authenticate to the device (e.g., via HTTP POST to login page).
2. Send a crafted request to /logsave.htm:

curl -v "http://<target>/logsave.htm?log_type=../../etc/passwd" --cookie "session=<valid_session>"

3. The response will contain the contents of /etc/passwd.

Example Output:

root:x:0:0:root:/root:/bin/sh
admin:x:1000:1000:admin:/home/admin:/bin/sh

Blue Team

Detection:

• Monitor HTTP requests to /logsave.htm with suspicious log_type parameters containing ../ or absolute paths.
• Alert on any file read attempts outside /var/log/.

Honeypot:

• Deploy a fake /logsave.htm endpoint that logs all requests and returns a decoy file.

Mitigation:

• Immediately restrict access to the management interface to trusted IPs only.
• Disable the /logsave.htm endpoint if not needed.

Indicators of Compromise (IOCs)

• Network:
  • HTTP GET requests to /logsave.htm with log_type containing ../ or / characters.
  • Unusual outbound data transfers from the device (e.g., large responses to small requests).
• File System:
  • Unexpected file reads from /etc/passwd, /etc/shadow, /etc/config/*, or /tmp/*.
• Logs:
  • Device logs showing access to /logsave.htm with non-standard parameters.

Detection Engineering

YARA Rule

rule CVE_2025_67115_PathTraversal {
    meta:
        description = "Detects path traversal attempts against Sercomm SCE4255W /logsave.htm"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-67115"
    strings:
        $traversal = /log_type=[^&]*\.\.\//
        $logsave = "/logsave.htm"
    condition:
        $logsave and $traversal
}

Sigma Rule

title: CVE-2025-67115 Path Traversal Attempt
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects path traversal attempts against Sercomm SCE4255W /logsave.htm
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/logsave.htm'
        cs-uri-query|contains: 'log_type='
    condition: selection and (cs-uri-query|contains: '..' or cs-uri-query|contains: '/')
falsepositives:
    - Legitimate log file names with dots (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-67115 Path Traversal Attempt"; flow:to_server; content:"/logsave.htm"; http_uri; content:"log_type="; http_uri; pcre:"/log_type=[^&]*\.\.\//i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Restrict access to the device management interface to trusted IPs only via firewall rules.
   • Change default credentials immediately.
   • Disable the /logsave.htm endpoint if not required for operations.

2. Vendor Patch:

   • Contact Sercomm for an official firmware update. The patched version is DG3934v3@2308041842 or later.
   • If no patch is available, consider replacing the device with a supported alternative.

3. Compensating Controls:

   • Deploy a Web Application Firewall (WAF) with rules to block path traversal patterns.
   • Implement network segmentation to isolate IoT/small cell devices from critical networks.

4. Long-Term:

   • Conduct a security audit of all Sercomm devices in the environment.
   • Implement a vulnerability management program for embedded systems.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert