CVE-2025-63225
Published: 18 November 2025
Description
The Eurolab ELTS100_UBX device (firmware version ELTS100v1.UBX) is vulnerable to Broken Access Control due to missing authentication on critical administrative endpoints. Attackers can directly access and modify sensitive system and network configurations, upload firmware, and execute unauthorized actions without any…
more
form of authentication. This vulnerability allows remote attackers to fully compromise the device, control its functionality, and disrupt its operation.
Mitigating Controls (NIST 800-53 r5)AI
Directly restricts and documents permitted actions without identification or authentication, ensuring critical administrative endpoints require credentials to prevent unauthorized access.
Enforces approved authorizations for access to system resources including administrative endpoints, comprehensively addressing the missing access enforcement on sensitive functions.
Mandates identification and authentication for services and non-organizational users before establishing network connections to device endpoints, blocking unauthenticated remote exploitation.
Security SummaryAI
CVE-2025-63225, published on 2025-11-18, is a Broken Access Control vulnerability (CWE-284) in the Eurolab ELTS100_UBX device running firmware version ELTS100v1.UBX. It arises from missing authentication on critical administrative endpoints, enabling direct access to sensitive functions without any credentials. The issue has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its high impact on confidentiality, integrity, and availability.
Remote attackers require only network access to exploit this vulnerability, with no privileges, user interaction, or complex conditions needed. Successful exploitation allows attackers to modify sensitive system and network configurations, upload new firmware, and execute unauthorized actions. This grants full compromise of the device, enabling control over its functionality and potential disruption of operations.
Vendor advisories and vulnerability research are available at http://eurolab-srl.com/ and https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63225_Eurolab_ELTS100_UBX_Broken_Access_Control, which may provide further details on patches or mitigation steps.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability involves missing authentication on public-facing administrative endpoints, directly enabling exploitation of a public-facing application for initial access and full device compromise.