CVE-2025-54083
BaseFortify
Publication date: 2025-09-09
Last updated on: 2025-09-12
Assigner: Fluid Attacks
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| calix | gigacenter_ont | 844e |
| calix | gigacenter_ont | 812g |
| calix | gigacenter_ont | 844g |
| calix | gigacenter_ont | 818g |
| calix | gigacenter_ont | 844ge |
| calix | gigacenter_ont | 854ge |
| calix | gigacenter_ont | 813g |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-922 | The product stores sensitive information without properly limiting read or write access by unauthorized actors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-54083 is a vulnerability in Calix GigaCenter ONT devices where sensitive information, such as the WPA2 pre-shared key and administrative credentials, is stored insecurely in the device's firmware. The WPA2 key is stored in plaintext, and admin credentials are weakly hashed with MD5. An attacker with physical access can extract the firmware from the device's SPI flash memory, recover the plaintext WPA2 password, and crack the admin credentials quickly, gaining unauthorized admin access to the device's web interface. [1]
How can this vulnerability impact me? :
This vulnerability can allow an attacker with physical access to your Calix GigaCenter ONT device to obtain your Wi-Fi WPA2 password and administrative credentials. This enables unauthorized access to your network and device management interface, potentially compromising network security and control over the device. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by physically extracting the firmware from the SPI SOP8 flash memory of the affected Calix GigaCenter ONT devices using a CH341 programmer. After extraction, the JFFS2 filesystem can be analyzed to check for plaintext WPA2 pre-shared keys in the hostapd.conf file and MD5-hashed administrative credentials in the admin.conf file. There are no specific network commands provided to detect this remotely, as exploitation requires physical access. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to apply the vendor's patch R12.2.13.4 released on September 5, 2025. Since the patch is available only to authorized users, subscribers should contact their broadband service providers to ensure the update is applied. This patch addresses the insecure storage of sensitive information in the firmware. [1]