CVE-2025-63224
📋 TL;DR
This vulnerability allows attackers to bypass authentication on Itel DAB Encoder devices by reusing a valid JWT token from one device to gain administrative access to any other device running the same firmware. This leads to full compromise of affected devices regardless of individual device passwords or network configurations. All devices running IDEnc build 25aec8d are affected.
💻 Affected Systems
- Itel DAB Encoder
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of all affected devices across an organization, allowing attackers to manipulate audio encoding, exfiltrate data, or use devices as footholds for lateral movement.
Likely Case
Unauthorized administrative access to DAB encoder devices, enabling configuration changes, service disruption, or data interception.
If Mitigated
Limited impact if devices are isolated in secure network segments with strict access controls and monitoring.
🎯 Exploit Status
Exploitation requires obtaining a valid JWT token from any vulnerable device first, but token reuse is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.itel.it/
Restart Required: Yes
Instructions:
1. Contact Itel for firmware updates. 2. Apply updated firmware to all devices. 3. Restart devices after patching. 4. Rotate all JWT tokens.
🔧 Temporary Workarounds
Network Segmentation
allIsolate DAB encoder devices in separate VLANs with strict firewall rules limiting access to authorized management systems only.
JWT Token Monitoring
allImplement monitoring to detect unusual JWT token usage patterns across devices.
🧯 If You Can't Patch
- Implement strict network access controls to limit device communication to only necessary systems.
- Deploy network monitoring to detect anomalous authentication attempts and token reuse patterns.
🔍 How to Verify
Check if Vulnerable:
Check firmware version via device web interface or SSH: look for IDEnc build 25aec8d in version information.Check Version:
ssh admin@device-ip 'cat /etc/version' or check web interface system infoVerify Fix Applied:
Verify firmware version has changed from 25aec8d and test that JWT tokens cannot be reused across devices.📡 Detection & Monitoring
Log Indicators:
- Multiple authentication successes with same JWT token across different devices
- Administrative actions from unexpected IP addresses
Network Indicators:
- HTTP requests with JWT tokens to multiple device IPs
- Unusual administrative traffic patterns
SIEM Query:
source="dab-encoder-logs" AND (event_type="auth_success" AND jwt_token=*) | stats count by jwt_token, dest_ip | where count > 1