Cyber Posture

CVE-2025-22939

CriticalPublic PoC

Published: 31 March 2025

Published
31 March 2025
Modified
18 August 2025
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.1822 95.2th percentile
Risk Priority 31 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse Unix shell commands and scripts for execution.

Security Summary

CVE-2025-22939 is a command injection vulnerability (CWE-77) in the telnet service of the Adtran 411 ONT running firmware version L80.00.0011.M2. This flaw enables attackers to escalate privileges to root and execute arbitrary commands on the affected device. The vulnerability received a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low attack complexity, and lack of required privileges or user interaction.

Remote attackers can exploit this vulnerability over the network by sending specially crafted input to the telnet service, achieving unauthenticated root privilege escalation and full arbitrary command execution. Successful exploitation grants complete control over the ONT device, potentially allowing attackers to manipulate network traffic, install persistent malware, or pivot to other systems in the ISP environment.

Mitigation details and further technical analysis are available in advisories referenced at https://drive.google.com/file/d/1levaZk5aC6g6a2zPW8xlOIVAu9MFYvAz/view, https://lanrat.com/posts/adtran-isp-hacking/, and https://www.youtube.com/watch?v=Aic-QaSqjxc. Security practitioners should review these sources for patch availability or workaround guidance specific to Adtran 411 ONT deployments.

Details

CWE(s)
CWE-77

Affected Products

adtran
411 firmware
l80.00.0011.m2

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

Command injection in exposed telnet service directly enables remote unauthenticated arbitrary command execution on Unix-based device and root privilege escalation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References