{"id":31201,"date":"2025-04-25T15:20:07","date_gmt":"2025-04-25T15:20:07","guid":{"rendered":""},"modified":"2025-10-04T00:32:29","modified_gmt":"2025-10-04T06:32:29","slug":"cve-2025-28230-critical-access-control-vulnerability-in-jmbroadcast-jmb0150-firmware","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-28230-critical-access-control-vulnerability-in-jmbroadcast-jmb0150-firmware\/","title":{"rendered":"<strong>CVE-2025-28230: Critical Access Control Vulnerability in JMBroadcast JMB0150 Firmware<\/strong>"},"content":{"rendered":"<p><strong>Overview<\/strong><\/p>\n<p>A new vulnerability, dubbed CVE-2025-28230, has emerged in the cybersecurity landscape, posing a serious threat to JMBroadcast JMB0150 Firmware users worldwide. This critical vulnerability stems from incorrect access control measures in the software and paves the way for attackers to access hardcoded administrator credentials. This <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-32656-critical-php-remote-file-inclusion-vulnerability-in-notfound-testimonial-slider-and-showcase-pro\/\"  data-wpil-monitor-id=\"35584\">vulnerability has been rated as &#8220;Critical,&#8221;<\/a> with a CVSS Severity Score of 9.1, indicating its potential to cause severe damage if exploited. Given the ubiquity of JMBroadcast JMB0150 Firmware in various industries, the <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-26927-epc-ai-hub-unrestricted-file-upload-vulnerability-leading-to-system-compromise\/\"  data-wpil-monitor-id=\"36105\">vulnerability puts an enormous number of systems<\/a> at risk.<\/p>\n<p><strong>Vulnerability Summary<\/strong><\/p>\n<p>CVE ID: CVE-2025-28230<br \/>\nSeverity: Critical (CVSS: 9.1)<br \/>\nAttack Vector: Network<br \/>\nPrivileges Required: None<br \/>\nUser Interaction: None<br \/>\nImpact: <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-28197-ssrf-vulnerability-in-crawl4ai-leading-to-potential-system-compromise\/\"  data-wpil-monitor-id=\"37986\">Potential system<\/a> compromise and data leakage.<\/p>\n<p><strong>Affected Products<\/strong><\/p><div id=\"ameeb-3994857800\" class=\"ameeb-content-2 ameeb-entity-placement\"><div style=\"border-left: 4px solid #555; padding-left: 20px; margin: 48px 0; font-family: Roboto, sans-serif; color: #ffffff; line-height: 1.6; max-width: 720px;\">\r\n  <h2 style=\"margin-top: 0; font-size: 22px; font-weight: 600; display: flex; align-items: center; letter-spacing: -0.02em;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"display: inline-flex; align-items: center; margin-right: 10px;\">\r\n      <img decoding=\"async\" src=\"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/10\/Best-App-icon-Ameeba.png\" alt=\"Ameeba Chat Icon\" style=\"width: 42px; height: 42px;\" \/>\r\n    <\/a>\r\n    Share secrets securely\r\n  <\/h2>\r\n\r\n  <p style=\"margin-bottom: 14px; color: #d1d5db;\">\r\n    Ameeba is private infrastructure for communication and sensitive work built on encrypted identity instead of exposed corporate identity systems.\r\n  <\/p>\r\n\r\n  <p style=\"margin-bottom: 18px; color: #a1a1aa;\">\r\n    Passwords, credentials, confidential files, screenshots, internal discussions, sensitive AI context, and private coordination should not become exposed across ordinary communication platforms.\r\n  <\/p>\r\n\r\n  <ul style=\"list-style: none; padding-left: 0; margin-bottom: 24px; color: #e4e4e7;\">\r\n    <li style=\"margin-bottom: 8px;\">\u2022 Encrypted identity<\/li>\r\n    <li style=\"margin-bottom: 8px;\">\u2022 Private Spaces for organizations and teams<\/li>\r\n    <li style=\"margin-bottom: 8px;\">\u2022 End-to-end encrypted chat, calls, files, and notes<\/li>\r\n    <li style=\"margin-bottom: 8px;\">\u2022 Sensitive AI work and protected collaboration<\/li>\r\n    <li>\u2022 Built for information that cannot leak<\/li>\r\n  <\/ul>\r\n\r\n  <p style=\"font-style: italic; font-weight: 600; margin-bottom: 24px; color: #ffffff;\">\r\n    Our mission is to secure human work alongside AI.\r\n  <\/p>\r\n\r\n  <div style=\"display: flex; flex-wrap: wrap; gap: 12px;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\/download\" style=\"background-color: #ffffff; color: #000000; padding: 10px 20px; text-decoration: none; border-radius: 8px; font-weight: 500;\">\r\n      Download Ameeba\r\n    <\/a>\r\n\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"border: 1px solid #ffffff; color: #ffffff; padding: 10px 20px; text-decoration: none; border-radius: 8px; font-weight: 500;\">\r\n      Learn More\r\n    <\/a>\r\n  <\/div>\r\n<\/div><\/div>\n<p>Product | Affected Versions<\/p>\n<p><a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-28232-unauthenticated-access-to-admin-panel-in-jmbroadcast-jmb0150-firmware-v1-0\/\"  data-wpil-monitor-id=\"37636\">JMBroadcast JMB0150 Firmware<\/a> | v1.0<\/p>\n<p><strong>How the Exploit Works<\/strong><\/p>\n<p>The exploit works by taking advantage of the incorrect access <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-28229-critical-access-control-vulnerability-in-orban-optimod-5950-firmware-and-system\/\"  data-wpil-monitor-id=\"37216\">control measures that are currently in place in the JMBroadcast<\/a> JMB0150 Firmware v1.0. These measures allow for the existence of hardcoded administrator credentials which an attacker can leverage to gain <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-30960-unauthorized-access-vulnerability-in-notfound-fs-poster\/\"  data-wpil-monitor-id=\"36351\">unauthorized access<\/a>. The attacker does not require any <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-27812-local-privilege-escalation-vulnerability-in-msi-center\/\"  data-wpil-monitor-id=\"35523\">privileges or user interaction to exploit this vulnerability<\/a>. Once the attacker has gained access to these credentials, they can perform any number of unauthorized actions, <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-30727-unpatched-vulnerability-in-oracle-scripting-leads-to-potential-system-compromise\/\"  data-wpil-monitor-id=\"35771\">leading to potential system<\/a> compromise and data leakage.<\/p>\n<p><strong>Conceptual Example Code<\/strong><\/p><div id=\"ameeb-281392890\" class=\"ameeb-content ameeb-entity-placement\"><div class=\"poptin-embedded\" data-id=\"f6b387694f681\"><\/div>\r\n\r\n\r\n\r\n\r\n\r\n<\/div>\n<p>A conceptual example of how this <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-23394-critical-unix-symbolic-link-following-vulnerability-in-opensuse-tumbleweed-cyrus-imapd\/\"  data-wpil-monitor-id=\"54413\">vulnerability might be exploited is as follows<\/a>:<\/p>\n<pre><code class=\"\" data-line=\"\">GET \/admin\/login HTTP\/1.1\nHost: target.example.com\nAuthorization: Basic am1iYWRtaW46SGFyZGNvZGVkUGFzc3dvcmQ=<\/code><\/pre>\n<p>This HTTP request represents an attacker attempting to use the hardcoded administrator credentials to gain <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-25777-unauthorized-user-profile-access-in-codeastro-bus-ticket-booking-system\/\"  data-wpil-monitor-id=\"41352\">unauthorized access<\/a> to the system. The &#8216;Authorization&#8217; header is encoded in Base64 and would be equivalent to &#8220;jmbadmin:HardcodedPassword&#8221; when decoded. Please note that this is a conceptual example, the actual exploit may vary based on the specific <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2022-43110-critical-unauthenticated-remote-system-configuration-vulnerability-in-voltronic-power-viewpower-powershield-netguard\/\"  data-wpil-monitor-id=\"83132\">system configuration<\/a> and the attacker&#8217;s methodology.<\/p>\n<p><strong>Mitigation Guidance<\/strong><\/p>\n<p>To mitigate this vulnerability, users should immediately apply the vendor-provided patch for the JMBroadcast JMB0150 Firmware v1.0. In situations where the patch cannot be applied immediately, the use of a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) can be used as a temporary mitigation measure. These measures can help protect against <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-45746-unauthorized-system-access-via-hardcoded-jwt-secret-in-zkt-zkbio-cvsecurity\/\"  data-wpil-monitor-id=\"48917\">unauthorized access<\/a> attempts while the patch is being applied. As always, it is recommended to keep all <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-25180-underprivileged-software-manipulates-gpu-system-calls-for-unauthorized-access\/\"  data-wpil-monitor-id=\"88786\">software and systems<\/a> up to date to ensure the highest level of security.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Overview A new vulnerability, dubbed CVE-2025-28230, has emerged in the cybersecurity landscape, posing a serious threat to JMBroadcast JMB0150 Firmware users worldwide. This critical vulnerability stems from incorrect access control measures in the software and paves the way for attackers to access hardcoded administrator credentials. This vulnerability has been rated as &#8220;Critical,&#8221; with a CVSS [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-31201","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/31201","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/comments?post=31201"}],"version-history":[{"count":13,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/31201\/revisions"}],"predecessor-version":[{"id":81596,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/31201\/revisions\/81596"}],"wp:attachment":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/media?parent=31201"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/categories?post=31201"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/tags?post=31201"},{"taxonomy":"vendor","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/vendor?post=31201"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/product?post=31201"},{"taxonomy":"attack_vector","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/attack_vector?post=31201"},{"taxonomy":"asset_type","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/asset_type?post=31201"},{"taxonomy":"severity","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/severity?post=31201"},{"taxonomy":"exploit_status","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/exploit_status?post=31201"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}