CVE-2025-66963
📋 TL;DR
This vulnerability in Hitron HI3120 routers allows a local attacker to access sensitive information through the logout function on the index.html page. It affects users with physical or network access to the device. The issue stems from insufficient session expiration (CWE-200).
💻 Affected Systems
- Hitron HI3120
📦 What is this software?
Hi3120 Firmware by Hitrontech
⚠️ Risk & Real-World Impact
Worst Case
An attacker could obtain authentication credentials, session tokens, or other sensitive data that could lead to full device compromise.
Likely Case
Local users or attackers on the same network could access session information or user data that should be cleared upon logout.
If Mitigated
With proper network segmentation and access controls, impact is limited to authorized users only.
🎯 Exploit Status
Exploitation requires local access to the web interface. The GitHub reference suggests technical details are publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://hitron.com
Restart Required: No
Instructions:
Check Hitron's official website for firmware updates. If available, download and apply the latest firmware through the router's web interface.
🔧 Temporary Workarounds
Restrict Network Access
allLimit access to the router's web interface to trusted IP addresses only.
Configure firewall rules to restrict access to router management IP (typically 192.168.0.1 or 192.168.1.1)
Change Default Credentials
allEnsure strong, unique credentials are set for router administration.
Log into router web interface and change admin password in settings
🧯 If You Can't Patch
- Segment the network to isolate the router from untrusted devices
- Monitor for unusual access attempts to the router's management interface
🔍 How to Verify
Check if Vulnerable:
Access the router web interface, navigate to index.html, and test if session data persists after logout.Check Version:
Log into router web interface and check firmware version in System Status or similar sectionVerify Fix Applied:
After applying any firmware update, retest the logout functionality to ensure session data is properly cleared.📡 Detection & Monitoring
Log Indicators:
- Multiple logout attempts
- Unusual access patterns to index.html
Network Indicators:
- HTTP requests to router management interface from unexpected sources
SIEM Query:
source="router_logs" AND (url="*index.html*" AND action="logout")