CVE-2025-63361
📋 TL;DR
This vulnerability exposes the administrator password in plaintext on the web interface of Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway devices. Attackers with network access can view the password, potentially gaining administrative control. Organizations using this specific firmware version are affected.
💻 Affected Systems
- Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full administrative takeover of the gateway device, allowing attackers to reconfigure serial-to-network communications, intercept or modify industrial data, or use the device as a pivot point into operational technology networks.
Likely Case
Unauthorized administrative access leading to device configuration changes, network disruption, or data interception from connected serial devices.
If Mitigated
Limited impact if device is isolated in a segmented network with strict access controls and monitoring.
🎯 Exploit Status
The vulnerability requires only web browser access to view the plaintext password. No special tools or authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
No official patch available. Check vendor website for firmware updates and apply if available.
🔧 Temporary Workarounds
Network Segmentation
allIsolate the device in a separate VLAN or network segment with strict access controls.
Access Control Lists
allImplement firewall rules to restrict web interface access to authorized IP addresses only.
🧯 If You Can't Patch
- Change administrator password immediately and monitor for unauthorized access attempts.
- Disable web interface if not required, or restrict to HTTPS-only access with strong authentication.
🔍 How to Verify
Check if Vulnerable:
Access the device web interface and check if administrator password is displayed in plaintext on any configuration page.Check Version:
Check device web interface status page for firmware version: V3.1.1.0, HW 4.3.2.1, Webpage V7.04T.07.002880.0301Verify Fix Applied:
Verify that password fields are masked or encrypted in the web interface after any firmware update.📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts followed by successful login from unusual IP
- Configuration changes from unauthorized IP addresses
Network Indicators:
- HTTP requests to device web interface from unauthorized IPs
- Unusual traffic patterns from the gateway device
SIEM Query:
source_ip IN (unauthorized_ips) AND destination_port=80 AND http_user_agent CONTAINS 'Mozilla' AND destination_ip=gateway_ip