CVE-2025-63205
📋 TL;DR
This vulnerability allows attackers to retrieve sensitive information including administrator passwords via the /probe/core/setup/passwd endpoint in bridgetech probes devices. It affects multiple bridgetech probe models with firmware versions 5.6.0-3 and earlier (vendor statement) or 6.5.0-9 (researcher claim). Organizations using these network monitoring probes are at risk of credential compromise.
💻 Affected Systems
- VB220 IP Network Probe
- VB120 Embedded IP + RF Probe
- VB330 High-Capacity Probe
- VB440 ST 2110 Production Analytics Probe
- NOMAD
📦 What is this software?
Vb120 Firmware by Bridgetech
Vb220 Firmware by Bridgetech
Vb330 Firmware by Bridgetech
Vb440 Firmware by Bridgetech
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrator credentials, take full control of probes, intercept sensitive network traffic, and pivot to other network systems.
Likely Case
Attackers harvest administrator passwords, compromise probe functionality, and access network monitoring data.
If Mitigated
Attackers can access the endpoint but find no useful credentials due to proper access controls and credential management.
🎯 Exploit Status
Simple HTTP request to endpoint. Researcher has published details on GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.6.0-4 (2020-09-21) and later
Vendor Advisory: https://bridgetech.tv/
Restart Required: Yes
Instructions:
1. Verify current firmware version. 2. Download firmware 5.6.0-4 or later from bridgetech.tv. 3. Apply firmware update via web interface or CLI. 4. Reboot device. 5. Verify update successful.
🔧 Temporary Workarounds
Network Access Control
linuxRestrict access to probe management interfaces to trusted IPs only
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Endpoint Protection
allBlock requests to vulnerable endpoint using WAF or reverse proxy
location /probe/core/setup/passwd { deny all; return 403; }
🧯 If You Can't Patch
- Isolate probes in separate VLAN with strict access controls
- Implement network monitoring for unauthorized access to /probe/core/setup/passwd endpoint
🔍 How to Verify
Check if Vulnerable:
Send HTTP GET request to http://[probe_ip]/probe/core/setup/passwd and check if sensitive information is returnedCheck Version:
Check web interface or use SNMP to query firmware versionVerify Fix Applied:
After patching, same request should return error or no sensitive data📡 Detection & Monitoring
Log Indicators:
- HTTP GET requests to /probe/core/setup/passwd
- Multiple failed authentication attempts followed by successful access
Network Indicators:
- Unusual traffic patterns to probe management interfaces
- Requests to /probe/core/setup/passwd from unauthorized IPs
SIEM Query:
source="probe_logs" AND uri="/probe/core/setup/passwd"