CVE-2025-25684
Published: 17 March 2025
Description
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
Security Summary
CVE-2025-25684 is a path traversal vulnerability (CWE-22) in the GL-INet Beryl AX GL-MT3000 router running firmware version v4.7.0. The issue stems from insufficient validation of the path parameter in the /download endpoint, enabling attackers to traverse directories and access arbitrary files on the device's file system through a specially crafted POST request.
The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating it is exploitable over the network with low complexity, no required privileges or user interaction, and no impact on integrity or availability. Remote attackers who can reach the router's web interface can send a malicious POST request to download sensitive files, such as configuration data or logs, potentially exposing credentials, keys, or other critical information.
Mitigation details and additional context are available in the advisory published at https://medium.com/@tfortinsec/multiple-path-traversal-vulnerabilities-in-the-beryl-ax-gl-mt300-router-e7f856d14af9.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Path traversal in unauthenticated web interface enables remote arbitrary file access on network device, directly supporting T1190 for initial access and T1552.001 for retrieving credentials/keys from config/logs.