CVE-2025-25684
Published: 17 March 2025
Summary
CVE-2025-25684 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 43.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-25684 is a path traversal vulnerability (CWE-22) in the GL-INet Beryl AX GL-MT3000 router running firmware version v4.7.0. The issue stems from insufficient validation of the path parameter in the /download endpoint, enabling attackers to traverse directories and access arbitrary files on the device's file system through a specially crafted POST request.
The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating it is exploitable over the network with low complexity, no required privileges or user interaction, and no impact on integrity or availability. Remote attackers who can reach the router's web interface can send a malicious POST request to download sensitive files, such as configuration data or logs, potentially exposing credentials, keys, or other critical information.
Mitigation details and additional context are available in the advisory published at https://medium.com/@tfortinsec/multiple-path-traversal-vulnerabilities-in-the-beryl-ax-gl-mt300-router-e7f856d14af9.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6546
Vulnerability details
A lack of validation in the path parameter (/download) of GL-INet Beryl AX GL-MT3000 v4.7.0 allows attackers to download arbitrary files from the device's file system via a crafted POST request.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in unauthenticated web interface enables remote arbitrary file access on network device, directly supporting T1190 for initial access and T1552.001 for retrieving credentials/keys from config/logs.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the path parameter in the /download endpoint to prevent path traversal and arbitrary file downloads exploited in this CVE.
Mandates identification, reporting, and correction of flaws such as this path traversal vulnerability through firmware updates.
Enforces logical access controls to restrict unauthorized file system access, mitigating impacts of insufficient path validation in the vulnerable endpoint.