CVE-2025-4552
📋 TL;DR
This vulnerability in ContiNew Admin allows unauthenticated attackers to remotely reset the super administrator password without verification. Affects ContiNew Admin versions up to 3.6.0, potentially enabling complete system takeover.
💻 Affected Systems
- ContiNew Admin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the ContiNew Admin system with attacker gaining super administrator privileges, leading to data theft, system manipulation, or deployment of additional malware.
Likely Case
Unauthorized password reset of super administrator account, allowing attacker to lock out legitimate administrators and take control of the administrative interface.
If Mitigated
Limited impact if system is behind strong network controls, uses multi-factor authentication, or has monitoring that detects unauthorized password changes.
🎯 Exploit Status
Exploit details are publicly available on GitHub, making this easily exploitable by attackers with basic technical skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor was contacted but did not respond. Consider upgrading to any version above 3.6.0 if available, or implement workarounds.
🔧 Temporary Workarounds
Block Vulnerable Endpoint
allConfigure web server or firewall to block access to /dev-api/system/user/1/password endpoint
# For Apache: RewriteRule ^/dev-api/system/user/1/password - [F]
# For Nginx: location ~ ^/dev-api/system/user/1/password { return 403; }
Network Segmentation
linuxRestrict access to ContiNew Admin administrative interface to trusted IP addresses only
# Example iptables rule: iptables -A INPUT -p tcp --dport [admin-port] -s [trusted-ip] -j ACCEPT
iptables -A INPUT -p tcp --dport [admin-port] -j DROP
🧯 If You Can't Patch
- Implement network-level controls to restrict access to the administrative interface
- Enable detailed logging and monitoring for unauthorized password change attempts
🔍 How to Verify
Check if Vulnerable:
Check if ContiNew Admin version is 3.6.0 or earlier and test if /dev-api/system/user/1/password endpoint accepts unauthenticated password reset requestsCheck Version:
Check application configuration files or administrative interface for version informationVerify Fix Applied:
Verify that /dev-api/system/user/1/password endpoint is no longer accessible or requires proper authentication📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /dev-api/system/user/1/password
- Failed login attempts followed by successful password reset
- Administrator password change events from unexpected IP addresses
Network Indicators:
- HTTP requests to /dev-api/system/user/1/password endpoint from untrusted sources
- Unusual traffic patterns to administrative interface
SIEM Query:
source="web_server" AND (uri="/dev-api/system/user/1/password" OR (event_type="password_change" AND user="admin"))