Executive Summary

CVE-2025-57174 is a critical unauthenticated remote command execution vulnerability in Siklu Communications Etherhaul 8010TX and 1200FX devices (firmware 7.4.0 through 10.7.3). The rfpiped service listens on TCP port 555 and uses static, hardcoded AES-256 encryption keys and predictable initialization vectors embedded in the binary. Because these keys are identical across all devices and there is no authentication for command packets, attackers can craft encrypted packets that the device accepts and executes arbitrary privileged commands without authentication, leading to full device compromise. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary privileged CLI commands on affected devices without authentication. This can lead to full device compromise, unauthorized administrative access, network infiltration, and potentially control over network infrastructure relying on these devices. Attackers can add administrative users and manipulate device configurations, severely impacting network security and availability. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring network traffic for connections or attempts to connect to TCP port 555, which is used by the vulnerable rfpiped service. You can use network scanning or packet capture tools to identify devices running this service. For example, using nmap to scan for open port 555 on your network: `nmap -p 555 <target-ip-range>`. Additionally, monitoring logs or using packet capture tools like tcpdump or Wireshark to analyze traffic on port 555 for suspicious encrypted packets may help detect exploitation attempts. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include isolating affected Siklu Etherhaul devices from untrusted networks, blocking TCP port 555 traffic using firewall rules, implementing strict access control lists (ACLs), and applying network segmentation to limit exposure. Monitoring port 555 for suspicious activity is also recommended. Since no patch is available at the time of disclosure, consider replacing vulnerable devices or disabling the rfpiped service if possible until a fix is released. [1]

Useful 0 Not Useful 0