SecBoard
Zurück zur CVE-Übersicht

CVE-2025-44018

HIGH(8.3)

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Risk Signal Score21/100 — NIEDRIG
  • CVSS 8.3 — Hoch

EPSS-Score

0.3%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

8.3

Technische Schwere

Beschreibung

A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4.7.0. A specially crafted .tar file can lead to a firmware downgrade. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceNetworkEvents
| where RemoteUrl contains "fw.gl-inet.com/firmware/axt1800/release/list-sha256.txt"
| where ActionType == "ConnectionAttempt"
| project DeviceName, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine

Splunk SPL

sourcetype=network_traffic url="*fw.gl-inet.com/firmware/axt1800/release/list-sha256.txt*" | table host, url, process

Sigma

title: GL-Inet GL-AXT1800 Firmware Downgrade Attempt
logsource:
  category: network_connection
  product: *
detection:
  selection:
    url|contains: 'fw.gl-inet.com/firmware/axt1800/release/list-sha256.txt'
  condition: selection
level: high

Elastic ES|QL

from network_connection
| where url : "*fw.gl-inet.com/firmware/axt1800/release/list-sha256.txt*"
| select host.name, url, process.name, process.command_line

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Indikatoren

Domains (1)

  • fw.gl-inet.com

Datei-Hashes (4)

  • fc9bf38d930e7281287b89525dda4c790be093e7adaba3b44316ed2e73150b98
  • eb11db2e26490e70ec3a9908a11880b104f043a28f84c9973039a85713ca7eae
  • f5912ed8f1add984cc1a6226f43fd52402821216ee36536313ae61f798a6e810
  • a3766797f96c0982bb0f9673be02f9cac640524d2e737019bf6c7865d7c37d9a

Übernommen wurden nur Indikatoren, die wörtlich in einer Hersteller- oder Research-Quelle standen.

Referenzen