CVE-2025-67015
📋 TL;DR
This vulnerability allows attackers to change the Administrator password and escalate privileges on Comtech EF Data CDM-625/CDM-625A satellite modems by sending a crafted POST request to the /Forms/admin_access_1 endpoint. It affects users running firmware version 2.5.1 on these devices. The broken access control enables unauthorized administrative access.
💻 Affected Systems
- Comtech EF Data CDM-625 Advanced Satellite Modem
- Comtech EF Data CDM-625A Advanced Satellite Modem
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of satellite modem configuration, allowing attackers to disrupt communications, intercept/modify traffic, or use the device as a pivot point into connected networks.
Likely Case
Unauthorized administrative access leading to configuration changes, service disruption, or credential theft.
If Mitigated
Limited impact if device is behind strict network controls with no external access.
🎯 Exploit Status
Exploit requires network access to the device's web interface. The GitHub reference contains technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.comtechefdata.com/
Restart Required: No
Instructions:
Check vendor website for security advisories and firmware updates. No specific patch information is currently available.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to the modem's management interface
Access Control Lists
allImplement firewall rules to block unauthorized access to /Forms/admin_access_1
🧯 If You Can't Patch
- Isolate the modem on a dedicated management VLAN with strict access controls
- Monitor network traffic for POST requests to /Forms/admin_access_1 and alert on suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface or CLI. If version is 2.5.1 and web interface is accessible, assume vulnerable.Check Version:
Check via web interface at System > About or via CLI with appropriate vendor commandsVerify Fix Applied:
Verify firmware has been updated to a version later than 2.5.1 or test if POST requests to /Forms/admin_access_1 are properly authenticated.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts followed by successful password changes
- POST requests to /Forms/admin_access_1 from unexpected sources
Network Indicators:
- HTTP POST requests to /Forms/admin_access_1 endpoint
- Unusual administrative login patterns
SIEM Query:
http.method:POST AND http.uri:"/Forms/admin_access_1"