CVE-2025-22941
Published: 31 March 2025
Summary
CVE-2025-22941 is a critical-severity Command Injection (CWE-77) vulnerability in Adtran 411 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 11.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A command injection vulnerability exists in the web interface of the Adtran 411 ONT running firmware version L80.00.0011.M2. Tracked as CVE-2025-22941 and assigned CWE-77, the flaw permits unauthenticated remote attackers to inject and execute operating system commands, resulting in privilege escalation to root and full control over the device. It carries a CVSS 3.1 base score of 9.8, reflecting network attack vector, low complexity, and no required credentials or user interaction.
An attacker with network access to the web interface can directly submit crafted input that bypasses authentication controls and executes arbitrary commands with root privileges. Successful exploitation grants complete device compromise, including the ability to alter configuration, intercept traffic, or use the ONT as a foothold within an ISP subscriber network.
EPSS for the CVE rose from a low baseline to a peak of 0.1434 on 2026-03-14 before receding to the current value of 0.0401, indicating a clear post-disclosure increase in exploitation interest. Public references include technical analysis at lanrat.com/posts/adtran-isp-hacking along with supporting documentation hosted on Google Drive.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8764
Vulnerability details
A command injection vulnerability in the web interface of Adtran 411 ONT L80.00.0011.M2 allows attackers to escalate privileges to root and execute arbitrary commands.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in unauthenticated public web interface enables remote exploitation (T1190), arbitrary Unix shell command execution (T1059.004), and privilege escalation to root (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents command injection by enforcing input validation mechanisms at the web interface entry points exploited in this CVE.
Addresses the specific flaw in Adtran firmware L80.00.0011.M2 through timely identification, reporting, and patching.
Mitigates exposure by restricting the web management interface to least functionality, disabling unnecessary features vulnerable to unauthenticated command injection.