Executive Summary

CVE-2025-54083 is a vulnerability in Calix GigaCenter ONT devices where sensitive information, such as the WPA2 pre-shared key and administrative credentials, is stored insecurely in the device's firmware. The WPA2 key is stored in plaintext, and admin credentials are weakly hashed with MD5. An attacker with physical access can extract the firmware from the device's SPI flash memory, recover the plaintext WPA2 password, and crack the admin credentials quickly, gaining unauthorized admin access to the device's web interface. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with physical access to your Calix GigaCenter ONT device to obtain your Wi-Fi WPA2 password and administrative credentials. This enables unauthorized access to your network and device management interface, potentially compromising network security and control over the device. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by physically extracting the firmware from the SPI SOP8 flash memory of the affected Calix GigaCenter ONT devices using a CH341 programmer. After extraction, the JFFS2 filesystem can be analyzed to check for plaintext WPA2 pre-shared keys in the hostapd.conf file and MD5-hashed administrative credentials in the admin.conf file. There are no specific network commands provided to detect this remotely, as exploitation requires physical access. [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to apply the vendor's patch R12.2.13.4 released on September 5, 2025. Since the patch is available only to authorized users, subscribers should contact their broadband service providers to ensure the update is applied. This patch addresses the insecure storage of sensitive information in the firmware. [1]

Useful 0 Not Useful 0