CVE-2025-63218
📋 TL;DR
This vulnerability allows unauthenticated remote attackers to completely compromise Axel Technology WOLF1MS and WOLF2MS devices by accessing the /cgi-bin/gstFcgi.fcgi endpoint without authentication. Attackers can create administrative users, delete existing users, modify system settings, and take full control of affected devices. Organizations using these devices with firmware versions 0.8.5 through 1.0.3 are at risk.
💻 Affected Systems
- Axel Technology WOLF1MS
- Axel Technology WOLF2MS
📦 What is this software?
Wolf1ms Firmware by Axeltechnology
Wolf2ms Firmware by Axeltechnology
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover allowing attackers to create persistent backdoors, exfiltrate data, pivot to internal networks, and use devices for botnet participation or further attacks.
Likely Case
Unauthorized administrative access leading to configuration changes, user account manipulation, and potential data exposure from connected systems.
If Mitigated
Limited impact if devices are behind strict network segmentation with no internet exposure and proper authentication controls on other interfaces.
🎯 Exploit Status
Simple HTTP requests to the vulnerable endpoint with no authentication required. Public GitHub repository contains proof-of-concept.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.axeltechnology.com/
Restart Required: No
Instructions:
Check vendor website for firmware updates. If available, download latest firmware and follow vendor's update procedures.
🔧 Temporary Workarounds
Network Access Control
allRestrict network access to affected devices using firewall rules or network segmentation.
Web Application Firewall
allDeploy WAF rules to block requests to /cgi-bin/gstFcgi.fcgi endpoint.
🧯 If You Can't Patch
- Isolate affected devices in separate network segments with strict firewall rules
- Implement network monitoring and intrusion detection for suspicious access to the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Send HTTP GET request to http://[device_ip]/cgi-bin/gstFcgi.fcgi and check if it responds without authentication.Check Version:
Check device web interface or console for firmware version information.Verify Fix Applied:
Attempt the same request after remediation - should require authentication or return error.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated access to /cgi-bin/gstFcgi.fcgi
- Unexpected user creation/modification events
- Configuration changes from unknown sources
Network Indicators:
- HTTP requests to /cgi-bin/gstFcgi.fcgi from unauthorized IPs
- Unusual outbound connections from affected devices
SIEM Query:
source="device_logs" AND (uri="/cgi-bin/gstFcgi.fcgi" OR event="user_created" OR event="user_modified")