CVE-2025-63224
Published: 19 November 2025
Description
The Itel DAB Encoder (IDEnc build 25aec8d) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers can reuse a valid JWT token obtained from one device to authenticate and gain administrative access to any other device…
more
running the same firmware, even if the passwords and networks are different. This allows full compromise of affected devices.
Mitigating Controls (NIST 800-53 r5)AI
Implements unique identification and authentication mechanisms for users, directly preventing authentication bypass vulnerabilities from improper JWT validation.
Ensures communications session authenticity and uniqueness, mitigating JWT token reuse across devices akin to session fixation.
Mandates proper management, distribution, and validation of authenticators like JWT tokens to prevent cross-device exploitation.
Security SummaryAI
CVE-2025-63224 is an authentication bypass vulnerability in the Itel DAB Encoder (IDEnc build 25aec8d) stemming from improper JWT validation. This flaw affects devices running the same firmware, allowing JWT tokens to be shared across instances regardless of differing passwords or networks. Associated with CWE-287 (Improper Authentication) and CWE-384 (Session Fixation), it has a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating critical severity with network accessibility, low attack complexity, no prerequisites, and high impact on confidentiality, integrity, and availability.
Remote attackers require no privileges or user interaction to exploit this vulnerability. By obtaining a valid JWT token from one affected device, they can reuse it to authenticate and escalate to administrative access on any other device with the same firmware. This enables full compromise of targeted devices.
References for further details include vulnerability research at https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63224_Itel%20DAB%20Encoder%20Authentication%20Bypass and the vendor site at https://www.itel.it/. The CVE was published on 2025-11-19T16:15:48.450.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a critical authentication bypass in a network-accessible (AV:N) public-facing device application, enabling remote attackers to exploit improper JWT validation for unauthorized administrative access, directly mapping to Exploit Public-Facing Application.