{"id":31334,"date":"2025-04-25T18:21:38","date_gmt":"2025-04-25T18:21:38","guid":{"rendered":""},"modified":"2025-05-24T17:20:40","modified_gmt":"2025-05-24T17:20:40","slug":"cve-2025-28233-incorrect-access-control-vulnerability-in-bw-broadcast-hardware","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-28233-incorrect-access-control-vulnerability-in-bw-broadcast-hardware\/","title":{"rendered":"CVE-2025-28233: Incorrect Access Control Vulnerability in BW Broadcast Hardware<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The CVE-2025-28233 vulnerability resides in the incorrect access control mechanism of various BW Broadcast hardware versions. These include the TX600, TX300, TX150, TX1000, TX30, and TX50. The issue revolves around the software’s ability to control access<\/a> to log files, which can be exploited by attackers to extract session identifiers and execute session hijacking attacks. This vulnerability is of paramount importance as it can potentially lead to a total system compromise and data<\/a> leakage, affecting industries and organizations using the affected hardware.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-28233
\nSeverity: Critical (CVSS 9.1)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: System Compromise, Data Leakage<\/a><\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

BW Broadcast TX600 | Hardware v2, Software v1.6.0, Control v1.0, AIO Firmware v1.7
\nBW Broadcast TX300 | As above
\nBW Broadcast TX150 | As above
\nBW Broadcast TX1000 | As above
\nBW Broadcast TX30 | As above
\nBW Broadcast TX50 | As above<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The exploit leverages the faulty access control<\/a> mechanism in the affected software. By accessing the log files<\/a>, an attacker can extract session identifiers. With these identifiers, they can execute a session hijacking<\/a> attack, impersonating a genuine user. This allows them to bypass security measures and gain unauthorized access<\/a> to sensitive data or systems.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

An attacker might use an HTTP request to gain access<\/a> to the log files. Here’s a conceptual example:<\/p>\n

GET \/logfiles\/session_ids HTTP\/1.1\nHost: target.example.com<\/code><\/pre>\n
Once they have the session identifiers, they can use another HTTP request to impersonate a genuine user and hijack their session<\/a>:<\/p>\n
POST \/session\/login HTTP\/1.1\nHost: target.example.com\nContent-Type: application\/json\n{ \"session_id\": \"extracted_session_id\" }<\/code><\/pre>\n
Please note that these are simplified, conceptual examples. The actual exploit may involve additional steps or complex payloads.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The CVE-2025-28233 vulnerability resides in the incorrect access control mechanism of various BW Broadcast hardware versions. These include the TX600, TX300, TX150, TX1000, TX30, and TX50. The issue revolves around the software’s ability to control access to log files, which can be exploited by attackers to extract session identifiers and execute session hijacking attacks. […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-31334","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t