{"id":31201,"date":"2025-04-25T15:20:07","date_gmt":"2025-04-25T15:20:07","guid":{"rendered":""},"modified":"2025-10-04T00:32:29","modified_gmt":"2025-10-04T06:32:29","slug":"cve-2025-28230-critical-access-control-vulnerability-in-jmbroadcast-jmb0150-firmware","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-28230-critical-access-control-vulnerability-in-jmbroadcast-jmb0150-firmware\/","title":{"rendered":"<strong>CVE-2025-28230: Critical Access Control Vulnerability in JMBroadcast JMB0150 Firmware<\/strong>"},"content":{"rendered":"<p><strong>Overview<\/strong><\/p>\n<p>A new vulnerability, dubbed CVE-2025-28230, has emerged in the cybersecurity landscape, posing a serious threat to JMBroadcast JMB0150 Firmware users worldwide. This critical vulnerability stems from incorrect access control measures in the software and paves the way for attackers to access hardcoded administrator credentials. This <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-32656-critical-php-remote-file-inclusion-vulnerability-in-notfound-testimonial-slider-and-showcase-pro\/\"  data-wpil-monitor-id=\"35584\">vulnerability has been rated as &#8220;Critical,&#8221;<\/a> with a CVSS Severity Score of 9.1, indicating its potential to cause severe damage if exploited. Given the ubiquity of JMBroadcast JMB0150 Firmware in various industries, the <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-26927-epc-ai-hub-unrestricted-file-upload-vulnerability-leading-to-system-compromise\/\"  data-wpil-monitor-id=\"36105\">vulnerability puts an enormous number of systems<\/a> at risk.<\/p>\n<p><strong>Vulnerability Summary<\/strong><\/p>\n<p>CVE ID: CVE-2025-28230<br \/>\nSeverity: Critical (CVSS: 9.1)<br \/>\nAttack Vector: Network<br \/>\nPrivileges Required: None<br \/>\nUser Interaction: None<br \/>\nImpact: <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-28197-ssrf-vulnerability-in-crawl4ai-leading-to-potential-system-compromise\/\"  data-wpil-monitor-id=\"37986\">Potential system<\/a> compromise and data leakage.<\/p>\n<p><strong>Affected Products<\/strong><\/p><div id=\"ameeb-1903757308\" class=\"ameeb-content-2 ameeb-entity-placement\"><div style=\"border-left: 4px solid #555; padding-left: 20px; margin: 48px 0; font-family: Roboto, sans-serif; color: #ffffff; line-height: 1.6; max-width: 700px;\">\r\n  <h2 style=\"margin-top: 0; font-size: 20px; font-weight: 600; display: flex; align-items: center;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"display: inline-flex; align-items: center; margin-right: 8px;\">\r\n      <img decoding=\"async\" src=\"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/10\/Best-App-icon-Ameeba.png\" alt=\"Ameeba Chat Icon\" style=\"width: 40px; height: 40px;\" \/>\r\n    <\/a>\r\n    A new way to communicate\r\n  <\/h2>\r\n\r\n  <p style=\"margin-bottom: 12px;\">\r\n    Ameeba Chat is built on encrypted identity, not personal profiles.\r\n  <\/p>\r\n\r\n  <p style=\"margin-bottom: 16px;\">\r\n    Message, call, share files, and coordinate with identities kept separate.\r\n  <\/p>\r\n\r\n  <ul style=\"list-style: none; padding-left: 0; margin-bottom: 20px;\">\r\n    <li>\u2022 Encrypted identity<\/li>\r\n    <li>\u2022 Ameeba Chat authenticates access<\/li>\r\n    <li>\u2022 Aliases and categories<\/li>\r\n    <li>\u2022 End-to-end encrypted chat, calls, and files<\/li>\r\n    <li>\u2022 Secure notes for sensitive information<\/li>\r\n  <\/ul>\r\n\r\n  <p style=\"font-style: italic; font-weight: 600; margin-bottom: 24px;\">\r\n    Private communication, rethought.\r\n  <\/p>\r\n\r\n  <div style=\"display: flex; flex-wrap: wrap; gap: 12px;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\/download\" style=\"background-color: #ffffff; color: #000000; padding: 10px 20px; text-decoration: none; border-radius: 6px; font-weight: 500;\">Download Ameeba Chat<\/a>\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"border: 1px solid #ffffff; color: #ffffff; padding: 10px 20px; text-decoration: none; border-radius: 6px; font-weight: 500;\">Learn More<\/a>\r\n  <\/div>\r\n<\/div>\r\n<\/div>\n<p>Product | Affected Versions<\/p>\n<p><a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-28232-unauthenticated-access-to-admin-panel-in-jmbroadcast-jmb0150-firmware-v1-0\/\"  data-wpil-monitor-id=\"37636\">JMBroadcast JMB0150 Firmware<\/a> | v1.0<\/p>\n<p><strong>How the Exploit Works<\/strong><\/p>\n<p>The exploit works by taking advantage of the incorrect access <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-28229-critical-access-control-vulnerability-in-orban-optimod-5950-firmware-and-system\/\"  data-wpil-monitor-id=\"37216\">control measures that are currently in place in the JMBroadcast<\/a> JMB0150 Firmware v1.0. These measures allow for the existence of hardcoded administrator credentials which an attacker can leverage to gain <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-30960-unauthorized-access-vulnerability-in-notfound-fs-poster\/\"  data-wpil-monitor-id=\"36351\">unauthorized access<\/a>. The attacker does not require any <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-27812-local-privilege-escalation-vulnerability-in-msi-center\/\"  data-wpil-monitor-id=\"35523\">privileges or user interaction to exploit this vulnerability<\/a>. Once the attacker has gained access to these credentials, they can perform any number of unauthorized actions, <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-30727-unpatched-vulnerability-in-oracle-scripting-leads-to-potential-system-compromise\/\"  data-wpil-monitor-id=\"35771\">leading to potential system<\/a> compromise and data leakage.<\/p>\n<p><strong>Conceptual Example Code<\/strong><\/p><div id=\"ameeb-2549221110\" class=\"ameeb-content ameeb-entity-placement\"><div class=\"poptin-embedded\" data-id=\"f6b387694f681\"><\/div>\r\n\r\n\r\n\r\n\r\n\r\n<\/div>\n<p>A conceptual example of how this <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-23394-critical-unix-symbolic-link-following-vulnerability-in-opensuse-tumbleweed-cyrus-imapd\/\"  data-wpil-monitor-id=\"54413\">vulnerability might be exploited is as follows<\/a>:<\/p>\n<pre><code class=\"\" data-line=\"\">GET \/admin\/login HTTP\/1.1\nHost: target.example.com\nAuthorization: Basic am1iYWRtaW46SGFyZGNvZGVkUGFzc3dvcmQ=<\/code><\/pre>\n<p>This HTTP request represents an attacker attempting to use the hardcoded administrator credentials to gain <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-25777-unauthorized-user-profile-access-in-codeastro-bus-ticket-booking-system\/\"  data-wpil-monitor-id=\"41352\">unauthorized access<\/a> to the system. The &#8216;Authorization&#8217; header is encoded in Base64 and would be equivalent to &#8220;jmbadmin:HardcodedPassword&#8221; when decoded. Please note that this is a conceptual example, the actual exploit may vary based on the specific <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2022-43110-critical-unauthenticated-remote-system-configuration-vulnerability-in-voltronic-power-viewpower-powershield-netguard\/\"  data-wpil-monitor-id=\"83132\">system configuration<\/a> and the attacker&#8217;s methodology.<\/p>\n<p><strong>Mitigation Guidance<\/strong><\/p>\n<p>To mitigate this vulnerability, users should immediately apply the vendor-provided patch for the JMBroadcast JMB0150 Firmware v1.0. In situations where the patch cannot be applied immediately, the use of a Web Application Firewall (WAF) or an Intrusion Detection System (IDS) can be used as a temporary mitigation measure. These measures can help protect against <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-45746-unauthorized-system-access-via-hardcoded-jwt-secret-in-zkt-zkbio-cvsecurity\/\"  data-wpil-monitor-id=\"48917\">unauthorized access<\/a> attempts while the patch is being applied. As always, it is recommended to keep all <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-25180-underprivileged-software-manipulates-gpu-system-calls-for-unauthorized-access\/\"  data-wpil-monitor-id=\"88786\">software and systems<\/a> up to date to ensure the highest level of security.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Overview A new vulnerability, dubbed CVE-2025-28230, has emerged in the cybersecurity landscape, posing a serious threat to JMBroadcast JMB0150 Firmware users worldwide. This critical vulnerability stems from incorrect access control measures in the software and paves the way for attackers to access hardcoded administrator credentials. This vulnerability has been rated as &#8220;Critical,&#8221; with a CVSS [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-31201","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/31201","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/comments?post=31201"}],"version-history":[{"count":13,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/31201\/revisions"}],"predecessor-version":[{"id":81596,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/31201\/revisions\/81596"}],"wp:attachment":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/media?parent=31201"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/categories?post=31201"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/tags?post=31201"},{"taxonomy":"vendor","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/vendor?post=31201"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/product?post=31201"},{"taxonomy":"attack_vector","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/attack_vector?post=31201"},{"taxonomy":"asset_type","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/asset_type?post=31201"},{"taxonomy":"severity","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/severity?post=31201"},{"taxonomy":"exploit_status","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/exploit_status?post=31201"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}