CVE-2025-44887
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on affected FW-WGS-804HPT devices via a stack overflow in the web_radiusSrv_post function. Attackers can exploit this by sending specially crafted requests to the radIpkey parameter. Organizations using FW-WGS-804HPT v1.305b241111 are affected.
💻 Affected Systems
- FW-WGS-804HPT
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise leading to device takeover, network pivoting, and persistent backdoor installation
Likely Case
Remote code execution allowing attackers to modify device configuration, intercept network traffic, or launch attacks against internal systems
If Mitigated
Denial of service or limited information disclosure if exploit attempts are detected and blocked
🎯 Exploit Status
Detailed technical analysis and proof-of-concept are publicly available in the reference link
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
1. Check vendor website for firmware updates
2. If update available, download and verify checksum
3. Backup current configuration
4. Upload new firmware through web interface
5. Restore configuration if needed
🔧 Temporary Workarounds
Disable RADIUS server functionality
allDisable the RADIUS server feature if not required
Network segmentation and access control
linuxRestrict access to device web interface using firewall rules
iptables -A INPUT -p tcp --dport 80 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Isolate affected devices in a separate VLAN with strict network controls
- Implement WAF or reverse proxy to filter malicious requests to the web interface
🔍 How to Verify
Check if Vulnerable:
Check device firmware version in web interface under System > FirmwareCheck Version:
curl -s http://device-ip/status | grep -i versionVerify Fix Applied:
Verify firmware version is no longer v1.305b241111📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /web_radiusSrv_post
- Large payloads sent to radIpkey parameter
- Device crash or restart logs
Network Indicators:
- HTTP POST requests with oversized radIpkey parameter values
- Traffic to device web interface from unexpected sources
SIEM Query:
source="device_logs" AND (uri="/web_radiusSrv_post" OR parameter="radIpkey") AND size>1000