CVE-2025-23237
📋 TL;DR
This CVE describes an OS command injection vulnerability in UD-LT2 firmware that allows authenticated CLI users to execute arbitrary operating system commands. The vulnerability affects all versions up to and including Ver.1.00.008_SE. Attackers with CLI access can potentially gain full system control.
💻 Affected Systems
- IODATA UD-LT2
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to install malware, exfiltrate data, pivot to other systems, or render the device inoperable.
Likely Case
Privilege escalation leading to unauthorized access to sensitive data, configuration changes, or disruption of device functionality.
If Mitigated
Limited impact if proper network segmentation, access controls, and monitoring are implemented to restrict CLI access.
🎯 Exploit Status
Exploitation requires CLI access; command injection vulnerabilities are typically straightforward to exploit once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Ver.1.00.009 or later
Vendor Advisory: https://www.iodata.jp/support/information/2025/01_ud-lt2/
Restart Required: Yes
Instructions:
1. Download firmware update from IODATA support site. 2. Backup current configuration. 3. Apply firmware update via web interface or CLI. 4. Reboot device. 5. Verify firmware version.
🔧 Temporary Workarounds
Restrict CLI Access
allLimit CLI access to trusted administrators only using network controls and authentication.
Network Segmentation
allIsolate UD-LT2 devices on separate VLANs with strict firewall rules.
🧯 If You Can't Patch
- Implement strict access controls to limit CLI access to essential personnel only
- Monitor CLI access logs for suspicious activity and implement network segmentation
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface or CLI; if version is 1.00.008_SE or earlier, device is vulnerable.Check Version:
show version (CLI) or check System Information in web interfaceVerify Fix Applied:
Verify firmware version is 1.00.009 or later after applying update.📡 Detection & Monitoring
Log Indicators:
- Unusual CLI login attempts
- Suspicious command execution patterns
- Multiple failed authentication attempts
Network Indicators:
- Unexpected outbound connections from UD-LT2
- Traffic to unusual ports or destinations
SIEM Query:
source="ud-lt2" AND (event_type="cli_login" OR event_type="command_execution")