CVE-2025-45814
📋 TL;DR
Missing authentication checks in the query.fcgi endpoint of NovelSat NS3000 and NS2000 satellite modems allow attackers to hijack active sessions without credentials. This affects NS3000 v8.1.1.125110, v7.2.8.124852, and v7.x versions, and NS2000 v7.02.08. Attackers can gain unauthorized access to modem management interfaces.
💻 Affected Systems
- NovelSat NS3000
- NovelSat NS2000
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of satellite modem infrastructure allowing attackers to intercept, modify, or disrupt satellite communications, potentially affecting critical infrastructure.
Likely Case
Unauthorized access to modem management interface leading to configuration changes, service disruption, or data interception.
If Mitigated
Limited impact if network segmentation prevents external access and strong authentication is enforced elsewhere.
🎯 Exploit Status
Public GitHub repository contains research details; exploitation requires network access to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://novelsat.com/
Restart Required: No
Instructions:
1. Check NovelSat website for security advisories. 2. Apply any available firmware updates. 3. Verify authentication is properly enforced on query.fcgi endpoint.
🔧 Temporary Workarounds
Network Access Control
linuxRestrict network access to NovelSat devices to authorized management networks only.
iptables -A INPUT -p tcp --dport [device_port] -s [trusted_network] -j ACCEPT
iptables -A INPUT -p tcp --dport [device_port] -j DROP
Web Application Firewall Rules
allBlock or monitor requests to query.fcgi endpoint from unauthorized sources.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate NovelSat devices from untrusted networks.
- Deploy intrusion detection systems to monitor for unauthorized access attempts to query.fcgi endpoints.
🔍 How to Verify
Check if Vulnerable:
Attempt to access query.fcgi endpoint without authentication; if accessible, device is vulnerable.Check Version:
Check device web interface or console for firmware version information.Verify Fix Applied:
Verify that authentication is required for all query.fcgi endpoint requests after applying mitigations.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated access to query.fcgi endpoint
- Multiple failed authentication attempts followed by successful query.fcgi access
Network Indicators:
- Unusual traffic patterns to query.fcgi endpoint from unexpected sources
- HTTP requests to query.fcgi without authentication headers
SIEM Query:
source_ip=* AND destination_port=[device_port] AND url_path="*query.fcgi*" AND NOT auth_token=*