CVE-2025-7635
BaseFortify
Publication date: 2025-09-09
Last updated on: 2025-09-12
Assigner: Fluid Attacks
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| calix | gigacenter_ont | 844e |
| calix | gigacenter_ont | 812g |
| calix | gigacenter_ont | 4.0 |
| calix | gigacenter_ont | 844g |
| calix | gigacenter_ont | 818g |
| calix | gigacenter_ont | 844ge |
| calix | gigacenter_ont | 854ge |
| calix | gigacenter_ont | 4.16l.05xponpatch2 |
| calix | gigacenter_ont | 813g |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include contacting your broadband service provider (BSP) to apply the official patch (R12.2.13.4) released on August 1, 2025, as the devices are not consumer-licensed and updates are only available to authorized users. Additionally, restrict local network access to the Quantenna interface IP to prevent unauthorized Telnet connections until the patch is applied. [1]
Can you explain this vulnerability to me?
CVE-2025-7635 is an unauthenticated Telnet access vulnerability in Calix GigaCenter ONT models 844E, 844G, 844GE, and 854GE. It occurs because a Telnet service on the Quantenna SoC interface is exposed without requiring authentication during the device boot process. Attackers with local network access can connect to this Telnet service using default usernames "admin" or "root" without a password, gaining unauthorized root-level administrative access to the device. [1]
How can this vulnerability impact me? :
This vulnerability allows an attacker with local network access to gain root-level administrative control over the affected Calix GigaCenter ONT devices without authentication. This can lead to unauthorized device configuration changes, potential leakage of sensitive information such as pre-shared keys (PSKs), and further compromise of the network or connected systems. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by scanning for an open Telnet service (port 23) on the Quantenna interface IP of the affected Calix GigaCenter ONT devices. You can use Nmap to scan port 23 on the suspected device IP. If port 23 is open, attempt to connect via Telnet using usernames "admin" or "root" without a password. Successful unauthenticated access indicates the vulnerability is present. [1]