Overview
This report discusses CVE-2025-52492, a critical vulnerability discovered in the firmware of Paxton Paxton10 versions prior to 4.6 SR6. This vulnerability is of significant concern as it could potentially lead to unauthorized access, information disclosure, and disruption of services. The vulnerability lies in the hard-coded credentials for the Twilio API found in the firmware file, rootfs.tar.gz.
Vulnerability Summary
CVE ID: CVE-2025-52492
Severity: High (7.5 CVSS Score)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Unauthorized access, information disclosure, potential service disruption, and unauthorized use of Twilio services.
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Paxton Paxton10 Firmware | Versions before 4.6 SR6
How the Exploit Works
An attacker who obtains a copy of the vulnerable firmware can extract the hard-coded credentials for the Twilio API. These credentials can then be used to gain unauthorized access to the associated Twilio account. This could lead to a variety of impacts, including information disclosure, potential service disruption, and unauthorized use of the Twilio services.
Conceptual Example Code
Consider an attacker obtaining a copy of the firmware and running the following command to extract the hard-coded credentials:
tar -xvf rootfs.tar.gz | grep -i 'Twilio'This command would extract the contents of the firmware file and search for any instances of ‘Twilio’, potentially revealing the hard-coded credentials.
