CVE-2025-65212
📋 TL;DR
This vulnerability allows unauthenticated attackers to download the core configuration file from NJHYST HY511 POE devices, extract MD5-hashed passwords, and gain administrative access to the device backend. It affects all devices running core versions before 2.1 and plugins before 0.1. Attackers can completely compromise affected devices without any authentication.
💻 Affected Systems
- NJHYST HY511 POE
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover leading to network compromise, data theft, and potential lateral movement within the network.
Likely Case
Unauthorized administrative access to device management, configuration changes, and potential credential harvesting from the configuration file.
If Mitigated
Limited to attempted exploitation attempts that fail due to proper network segmentation and access controls.
🎯 Exploit Status
Exploitation requires only HTTP requests to download configuration file and MD5 password cracking (trivial for weak passwords). Public references demonstrate the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Core 2.1 or later, Plugins 0.1 or later
Vendor Advisory: Not provided in references
Restart Required: Yes
Instructions:
1. Contact NJHYST for updated firmware. 2. Backup current configuration. 3. Apply firmware update to Core 2.1+ and Plugins 0.1+. 4. Restart device. 5. Verify fix by attempting to access configuration file without authentication.
🔧 Temporary Workarounds
Network Segmentation
allIsolate NJHYST HY511 POE devices from untrusted networks and restrict access to management interfaces.
Access Control Lists
allImplement firewall rules to only allow management access from trusted IP addresses.
🧯 If You Can't Patch
- Immediately remove devices from internet-facing networks and place behind strict firewall rules.
- Monitor for unauthorized configuration file access attempts and implement network-based intrusion detection.
🔍 How to Verify
Check if Vulnerable:
Attempt to access the configuration file URL without authentication. If the file downloads, the device is vulnerable.Check Version:
Check device web interface or CLI for firmware version. Should show Core >=2.1 and Plugins >=0.1.Verify Fix Applied:
After patching, attempt to access the configuration file URL without authentication. Access should be denied.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated requests to configuration file paths
- Multiple failed login attempts followed by successful login from new IP
Network Indicators:
- HTTP GET requests to configuration file endpoints from unauthorized sources
- Unusual administrative access patterns
SIEM Query:
source_ip NOT IN trusted_networks AND (url_path CONTAINS 'config' OR url_path CONTAINS 'backup') AND response_code=200