Executive Summary

CVE-2025-36729 is a privilege escalation vulnerability in RACOM M!DGE2 devices where a non-primary administrator user with admin rights to the web interface but without shell access can exploit the SDK testing endpoint to retrieve the master admin password and grant themselves root-level shell access. This bypasses security restrictions that should prevent such users from accessing or modifying sensitive configurations or gaining shell access. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can severely impact you by allowing an attacker with administrator web interface access to obtain the master admin password and escalate their privileges to root shell access. This can lead to full control over the device, compromising confidentiality, integrity, and availability of the system, potentially allowing unauthorized changes, data theft, or disruption of services. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if an administrator-level user without shell access can execute scripts via the web interface's SDK testing console at /admin/sdkTesting.php. For example, running the script `ADMIN_PWD = nb_config_get("admin.password"); printf(ADMIN_PWD);` in the SDK testing console will reveal the master admin password if the vulnerability exists. Additionally, the script `nb_config_set("user.0.shell=sh");` can be tested to see if shell access can be enabled improperly. Verification can be done by visiting /admin/userAccounts.php and attempting SSH access as the compromised user. [1]

Useful 0 Not Useful 0

Mitigation Strategies

No fix or patch is currently available for this vulnerability. Immediate mitigation steps include restricting administrator web interface access to only fully trusted users, monitoring for suspicious use of the SDK testing console at /admin/sdkTesting.php, and limiting network access to the device to prevent unauthorized exploitation. Consider isolating the device from untrusted networks and auditing user privileges to minimize risk. [1]

Useful 0 Not Useful 0