CVE-2025-63364
📋 TL;DR
The Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway transmits administrator credentials in plaintext during authentication. This allows attackers to intercept login credentials and gain administrative access to the device. All users of the affected firmware version are vulnerable.
💻 Affected Systems
- Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full administrative control of the device, allowing them to reconfigure settings, intercept serial communications, or use the device as a pivot point into connected industrial/OT networks.
Likely Case
Credential theft leading to unauthorized access, configuration changes, and potential disruption of serial communication services.
If Mitigated
Limited to credential exposure without successful exploitation if strong network segmentation and monitoring are in place.
🎯 Exploit Status
Exploitation requires network access to intercept authentication traffic. The referenced GitHub post demonstrates the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found in provided references
Restart Required: No
Instructions:
Check Waveshare website for firmware updates. If available, download and apply the latest firmware through the device's web interface.
🔧 Temporary Workarounds
Network Segmentation
allIsolate the device from untrusted networks and limit access to authorized management hosts only.
VPN/Encrypted Tunnel
allRequire VPN or encrypted tunnel for all administrative access to the device.
🧯 If You Can't Patch
- Change default credentials and implement strong password policies
- Monitor network traffic for plaintext credential transmission and unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Use network monitoring tools (Wireshark, tcpdump) to capture authentication traffic to the device's web interface and check if credentials are transmitted in plaintext.Check Version:
Check firmware version in device web interface under System Information or similar menu.Verify Fix Applied:
After applying any firmware update, repeat the network capture to verify credentials are now encrypted.📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts followed by successful login from unusual IP
- Configuration changes from unexpected sources
Network Indicators:
- Plaintext HTTP POST requests containing 'password' or similar fields to device management interface
- Unusual outbound connections from the device
SIEM Query:
source_ip="device_ip" AND http_method="POST" AND (http_uri CONTAINS "/login" OR http_uri CONTAINS "/auth") AND http_content CONTAINS "password="