CVE-2025-66953
📋 TL;DR
This CSRF vulnerability in narda miteq Uplink Power Control Unit UPC2 version 1.17 allows remote attackers to trick authenticated users into executing arbitrary code through the web management interface. Attackers can exploit multiple endpoints to perform unauthorized actions. Organizations using this specific hardware version are affected.
💻 Affected Systems
- narda miteq Uplink Power Control Unit UPC2
📦 What is this software?
Upc2 Firmware by Nardamiteq
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attacker to execute arbitrary code, modify device configurations, disrupt uplink power control operations, and potentially pivot to other network systems.
Likely Case
Unauthorized configuration changes to the power control unit leading to service disruption, incorrect power settings, or device malfunction.
If Mitigated
Limited impact with proper CSRF protections, network segmentation, and access controls in place.
🎯 Exploit Status
Exploitation requires authenticated user interaction but is technically simple. Public research available on GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.nardamiteq.com/
Restart Required: No
Instructions:
Check vendor website for firmware updates. If patch available, download and apply through web interface or console.
🔧 Temporary Workarounds
Implement CSRF Tokens
allAdd anti-CSRF tokens to all web forms and validate them server-side
Restrict Network Access
linuxLimit access to web management interface to trusted IP addresses only
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Segment the UPC2 device on isolated network VLAN
- Implement strict access controls and require VPN for management access
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or console. If version is 1.17, device is vulnerable.Check Version:
Check web interface system info page or use console command specific to deviceVerify Fix Applied:
Verify firmware version has been updated beyond 1.17. Test CSRF protection by attempting to submit forms without valid tokens.📡 Detection & Monitoring
Log Indicators:
- Multiple configuration changes from same session
- Unusual POST requests to vulnerable endpoints
- Configuration changes without corresponding user actions
Network Indicators:
- HTTP POST requests to /system_setup.htm, /set_clock.htm, /receiver_setup.htm, /cal.htm, /channel_setup.htm without referrer validation
- Cross-origin requests to management interface
SIEM Query:
source="web_logs" AND (uri="/system_setup.htm" OR uri="/set_clock.htm" OR uri="/receiver_setup.htm" OR uri="/cal.htm" OR uri="/channel_setup.htm") AND method="POST"🔗 References
- https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-66953%20_%20narda%20miteq%20Uplink%20Power%20Contril%20Unitl%20UPC2%20_%20CSRF
- https://www.nardamiteq.com/
- https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-66953%20_%20narda%20miteq%20Uplink%20Power%20Contril%20Unitl%20UPC2%20_%20CSRF
