CVE-2025-63208
📋 TL;DR
This vulnerability in bridgetech VB288 Objective QoE Content Extractor firmware version 5.6.0-8 allows unauthenticated attackers to retrieve administrator passwords via the /probe/core/setup/passwd endpoint. This affects organizations using this specific firmware version for content extraction and quality monitoring. The information disclosure could lead to complete system compromise.
💻 Affected Systems
- bridgetech VB288 Objective QoE Content Extractor
📦 What is this software?
Vb288 Firmware by Bridgetech
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative credentials, leading to full system takeover, data exfiltration, and potential lateral movement within the network.
Likely Case
Attackers obtain administrator passwords and gain unauthorized access to the device, potentially modifying configurations or extracting sensitive content data.
If Mitigated
With proper network segmentation and access controls, impact is limited to the specific device, though credentials would still be compromised.
🎯 Exploit Status
Simple HTTP GET request to the vulnerable endpoint returns password information without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://bridgetech.tv/
Restart Required: No
Instructions:
Check bridgetech.tv for security advisories and firmware updates. If available, download and apply the latest firmware version following vendor instructions.
🔧 Temporary Workarounds
Block Vulnerable Endpoint
linuxUse network firewall or web application firewall to block access to /probe/core/setup/passwd endpoint
iptables -A INPUT -p tcp --dport 80 -m string --string "/probe/core/setup/passwd" --algo bm -j DROP
Network Segmentation
allIsolate VB288 devices from untrusted networks and limit access to authorized management systems only
🧯 If You Can't Patch
- Change all administrator passwords immediately and monitor for unauthorized access
- Implement strict network access controls to limit who can reach the device management interface
🔍 How to Verify
Check if Vulnerable:
Send HTTP GET request to http://[device-ip]/probe/core/setup/passwd and check if password information is returned without authenticationCheck Version:
Check device web interface or use vendor-specific CLI commands to display firmware versionVerify Fix Applied:
After applying workarounds or updates, verify the endpoint no longer returns password information without proper authentication📡 Detection & Monitoring
Log Indicators:
- HTTP GET requests to /probe/core/setup/passwd
- Failed authentication attempts followed by successful access
Network Indicators:
- Unusual HTTP traffic patterns to the vulnerable endpoint
- External IP addresses accessing the management interface
SIEM Query:
source="web_logs" AND uri="/probe/core/setup/passwd" AND response_status=200