CVE-2025-63216
📋 TL;DR
This vulnerability allows attackers to bypass authentication on Itel DAB Gateway devices by reusing a valid JWT token from one device to gain administrative access to any other device running the same firmware. This leads to full compromise of affected devices. All users of Itel DAB Gateway with build c041640a are affected.
💻 Affected Systems
- Itel DAB Gateway
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete takeover of all affected devices across an organization, allowing data theft, network pivoting, and deployment of persistent malware.
Likely Case
Unauthorized administrative access to multiple devices, enabling configuration changes, data access, and potential lateral movement.
If Mitigated
Limited to isolated devices with strict network segmentation and monitoring.
🎯 Exploit Status
Exploitation requires obtaining a valid JWT token from any vulnerable device first, but once obtained, bypass is trivial.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.itel.it/
Restart Required: No
Instructions:
Check vendor website for firmware updates. If available, download and apply the patched firmware version.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected devices in separate network segments to limit lateral movement.
Access Control Lists
allImplement strict firewall rules to limit device access to authorized IPs only.
🧯 If You Can't Patch
- Immediately disconnect affected devices from networks until patched.
- Monitor network traffic to/from devices for unusual authentication patterns.
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or CLI. If build is c041640a, device is vulnerable.Check Version:
Check device documentation for version command, typically via web interface at device IP.Verify Fix Applied:
Verify firmware version has been updated to a version later than c041640a.📡 Detection & Monitoring
Log Indicators:
- Multiple authentication attempts with same JWT token across different devices
- Administrative access from unexpected IP addresses
Network Indicators:
- Unusual authentication traffic patterns between devices
- JWT tokens being reused across device boundaries
SIEM Query:
source="itel-dab-gateway" AND (event_type="auth" AND jwt_token_count > 1) OR (src_ip != expected_admin_ip AND action="admin_access")