CVE-2025-63206
📋 TL;DR
An authentication bypass vulnerability in Dasan Switch DS2924 web interface allows attackers to gain escalated privileges by storing crafted cookies in the browser. This affects firmware versions 1.01.18 and 1.02.00, potentially compromising network switches and connected systems.
💻 Affected Systems
- Dasan Switch DS2924
📦 What is this software?
Ds2924 Firmware by Dasannetworks
Ds2924 Firmware by Dasannetworks
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of network switch allowing reconfiguration, traffic interception, lateral movement to connected systems, and persistent backdoor access.
Likely Case
Unauthorized administrative access to switch configuration, enabling network disruption, VLAN manipulation, and credential harvesting.
If Mitigated
Limited impact if switches are isolated, have strict network controls, and authentication bypass attempts are detected and blocked.
🎯 Exploit Status
Exploit involves crafting specific cookies to bypass authentication checks. Public research available on GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://dasansmc.com/
Restart Required: No
Instructions:
1. Check vendor website for firmware updates. 2. If patch available, download and apply via web interface or TFTP. 3. Verify patch application by checking firmware version.
🔧 Temporary Workarounds
Disable Web Management Interface
allDisable HTTP/HTTPS web interface and use CLI/SSH only for management
configure terminal
no ip http server
no ip http secure-server
end
write memory
Restrict Management Access
allLimit web interface access to specific management IPs using ACLs
configure terminal
access-list 10 permit 192.168.1.0 0.0.0.255
ip http access-class 10
ip http secure-server access-class 10
end
write memory
🧯 If You Can't Patch
- Isolate affected switches in separate VLAN with strict firewall rules
- Implement network monitoring for authentication bypass attempts and cookie manipulation
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface or CLI command 'show version'. If version is 1.01.18 or 1.02.00, system is vulnerable.Check Version:
show versionVerify Fix Applied:
After applying workarounds, attempt to access web interface from unauthorized IPs or test cookie manipulation attempts.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts followed by successful access
- Unusual cookie values in HTTP requests
- Administrative configuration changes from unexpected IPs
Network Indicators:
- HTTP requests with crafted cookie headers to switch management IP
- Unusual administrative traffic patterns
SIEM Query:
source="switch_logs" AND (http_cookie CONTAINS "admin" OR http_cookie CONTAINS "privilege")