CVE-2025-44890
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on affected FW-WGS-804HPT devices via a stack overflow in the SNMP notification configuration function. Attackers can exploit this by sending specially crafted requests to the web interface. All users running the vulnerable firmware version are affected.
💻 Affected Systems
- FW-WGS-804HPT
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise leading to remote code execution, device takeover, and potential lateral movement within the network.
Likely Case
Remote code execution allowing attackers to install malware, create backdoors, or disrupt device functionality.
If Mitigated
Denial of service if exploit fails or is blocked, potentially crashing the web service.
🎯 Exploit Status
Public technical details available in the reference link. The vulnerability is in a web endpoint and requires no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
No official patch available. Monitor vendor website for firmware updates. Consider replacing device if no patch becomes available.
🔧 Temporary Workarounds
Disable SNMP Configuration Web Interface
allDisable SNMP configuration through the web interface if not required
Access device web interface > SNMP Configuration > Disable SNMP
Network Segmentation
linuxRestrict access to device web interface using firewall rules
iptables -A INPUT -p tcp --dport 80 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Isolate affected devices in a separate VLAN with strict firewall rules
- Implement network-based intrusion detection to monitor for exploit attempts
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface: System > Status > Firmware Version. If version is v1.305b241111, device is vulnerable.Check Version:
curl -k https://device-ip/status | grep FirmwareVerify Fix Applied:
Verify firmware has been updated to a version later than v1.305b241111📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /web_snmp_notifyv3_add_post endpoint
- Large host_ip parameter values in web logs
- Web service crashes or restarts
Network Indicators:
- POST requests to /web_snmp_notifyv3_add_post with oversized host_ip parameter
- Unusual traffic patterns to device web interface
SIEM Query:
source="web_logs" AND uri="/web_snmp_notifyv3_add_post" AND parameter="host_ip" AND length(parameter_value)>100