CVE-2025-52376
Published: 15 July 2025
Summary
CVE-2025-52376 is a critical-severity Improper Authentication (CWE-287) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and CM-7 (Least Functionality).
Deeper analysis
CVE-2025-52376 is an authentication bypass vulnerability affecting the /web/um_open_telnet.cgi endpoint in Nexxt Solutions NCM-X1800 Mesh Router firmware versions UV1.2.7 and below. The flaw allows remote attackers to enable the Telnet service without any authentication, circumventing built-in security controls. Once enabled, the Telnet server exposes hard-coded credentials that grant administrative shell access. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-287 (Improper Authentication) and CWE-798 (Use of Hard-coded Credentials).
Any unauthenticated remote attacker with network access to the vulnerable router can exploit this issue by sending a crafted request to the /web/um_open_telnet.cgi endpoint. This triggers the Telnet service to start, after which the attacker can connect using the hard-coded credentials to obtain full administrative privileges. Successful exploitation enables arbitrary command execution on the device, potentially leading to complete compromise, including data theft, configuration manipulation, or use as a pivot point in the network.
Public proof-of-concept exploits for CVE-2025-52376 are available on GitHub, including a detailed writeup documenting the attack methodology. No official vendor advisories or patches are referenced in available sources.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21439
Vulnerability details
An authentication bypass vulnerability in the /web/um_open_telnet.cgi endpoint in Nexxt Solutions NCM-X1800 Mesh Router firmware UV1.2.7 and below, allowing an attacker to remotely enable the Telnet service without authentication, bypassing security controls. The Telnet server is then accessible with hard-coded…
more
credentials, allowing attackers to gain administrative shell access and execute arbitrary commands on the device.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated exploitation of public web endpoint (T1190) to enable Telnet daemon, followed by hard-coded credential login for Unix shell command execution (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly identifies and restricts actions like enabling Telnet via the /web/um_open_telnet.cgi endpoint that can be performed without identification or authentication, preventing the bypass vulnerability.
Prohibits the use of hard-coded credentials exposed by the Telnet service, blocking administrative shell access even if the service is enabled.
Prohibits or restricts unnecessary and insecure protocols like Telnet, eliminating the attack surface regardless of the authentication bypass.