CVE-2025-63363
📋 TL;DR
This vulnerability allows attackers to execute de-authentication attacks against Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway devices by broadcasting crafted deauthentication and disassociation frames without authentication or encryption. This affects all users of the vulnerable firmware version, potentially disrupting serial-to-network communications.
💻 Affected Systems
- Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent denial-of-service attacks that completely disrupt all wireless communications of affected devices, potentially causing industrial/OT system downtime.
Likely Case
Intermittent network disconnections and communication failures for devices using wireless connectivity.
If Mitigated
Minimal impact if devices are used in wired-only mode or with proper network segmentation.
🎯 Exploit Status
De-authentication attacks are well-documented and tools like aireplay-ng can be used. The vulnerability specifically lacks Management Frame Protection (MFP/802.11w).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Check vendor website for firmware updates.
🔧 Temporary Workarounds
Disable Wi-Fi and use wired connection
allConfigure device to use only Ethernet connectivity instead of Wi-Fi
Access device web interface > Network Settings > Disable Wi-Fi
Implement network segmentation
allIsolate vulnerable devices in separate network segments with strict firewall rules
🧯 If You Can't Patch
- Deploy wireless intrusion detection systems to monitor for de-authentication attacks
- Physically secure devices to limit wireless access range
🔍 How to Verify
Check if Vulnerable:
Check device firmware version in web interface. If using firmware V3.1.1.0 with Wi-Fi enabled, device is vulnerable.Check Version:
Access device web interface at http://[device-ip] and check firmware version in System InformationVerify Fix Applied:
Verify Wi-Fi is disabled or device is updated to patched firmware version (when available).📡 Detection & Monitoring
Log Indicators:
- Multiple authentication failures
- Unexpected device disconnections
- Wi-Fi interface errors
Network Indicators:
- High volume of deauthentication frames from single source
- Spoofed MAC addresses in management frames
SIEM Query:
source="wireless" AND (event_type="deauth" OR event_type="disassoc") AND count > threshold