CVE-2025-36729
BaseFortify
Publication date: 2025-08-26
Last updated on: 2025-08-29
Assigner: Tenable Network Security, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| racom | m!dge2 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-36729 is a privilege escalation vulnerability in RACOM M!DGE2 devices where a non-primary administrator user with admin rights to the web interface but without shell access can exploit the SDK testing endpoint to retrieve the master admin password and grant themselves root-level shell access. This bypasses security restrictions that should prevent such users from accessing or modifying sensitive configurations or gaining shell access. [1]
How can this vulnerability impact me? :
This vulnerability can severely impact you by allowing an attacker with administrator web interface access to obtain the master admin password and escalate their privileges to root shell access. This can lead to full control over the device, compromising confidentiality, integrity, and availability of the system, potentially allowing unauthorized changes, data theft, or disruption of services. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if an administrator-level user without shell access can execute scripts via the web interface's SDK testing console at /admin/sdkTesting.php. For example, running the script `ADMIN_PWD = nb_config_get("admin.password"); printf(ADMIN_PWD);` in the SDK testing console will reveal the master admin password if the vulnerability exists. Additionally, the script `nb_config_set("user.0.shell=sh");` can be tested to see if shell access can be enabled improperly. Verification can be done by visiting /admin/userAccounts.php and attempting SSH access as the compromised user. [1]
What immediate steps should I take to mitigate this vulnerability?
No fix or patch is currently available for this vulnerability. Immediate mitigation steps include restricting administrator web interface access to only fully trusted users, monitoring for suspicious use of the SDK testing console at /admin/sdkTesting.php, and limiting network access to the device to prevent unauthorized exploitation. Consider isolating the device from untrusted networks and auditing user privileges to minimize risk. [1]