CVE-2025-12917
📋 TL;DR
A denial-of-service vulnerability exists in TOZED ZLT T10/T10PLUS routers version 3.04.15. Attackers on the local network can exploit the reboot handler component to crash the device, causing service disruption. This affects organizations using these specific router models with the vulnerable firmware.
💻 Affected Systems
- TOZED ZLT T10
- TOZED ZLT T10PLUS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent device crashes requiring manual power cycling, extended network downtime affecting all connected devices and services.
Likely Case
Temporary network disruption until device automatically reboots, intermittent connectivity issues for users.
If Mitigated
Minimal impact if network segmentation isolates routers from untrusted internal hosts.
🎯 Exploit Status
YouTube videos demonstrate exploitation; simple HTTP request manipulation triggers the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch exists. Monitor vendor website for firmware updates. Consider replacing devices if vendor remains unresponsive.
🔧 Temporary Workarounds
Network Segmentation
allIsolate router management interface to separate VLAN with strict access controls
Access Control Lists
allImplement firewall rules to restrict access to /reqproc/proc_post endpoint
🧯 If You Can't Patch
- Replace affected routers with different models from responsive vendors
- Implement network monitoring to detect exploitation attempts and alert on unusual reboot patterns
🔍 How to Verify
Check if Vulnerable:
Check router web interface or serial console for firmware version 3.04.15Check Version:
Check router admin interface at System > Firmware or via serial consoleVerify Fix Applied:
Verify firmware version has changed from 3.04.15; test if reboot handler still accepts malformed requests📡 Detection & Monitoring
Log Indicators:
- Multiple reboot events in short timeframe
- HTTP requests to /reqproc/proc_post with unusual parameters
Network Indicators:
- HTTP POST requests to router IP on port 80 targeting /reqproc/proc_post
SIEM Query:
source="router_logs" AND (event="reboot" OR uri="/reqproc/proc_post") | stats count by src_ip