CVE-2025-10957 in SY-GPON-2010-WADONT
Summary
by MITRE • 09/25/2025
This vulnerability exists in the Syrotech SY-GPON-2010-WADONT router due to improper access control in its FTP service. A remote attacker could exploit this vulnerability by establishing an FTP connection using default credentials, potentially gaining unauthorized access to configuration files, user credentials, or other sensitive information stored on the targeted device.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/27/2025
The Syrotech SY-GPON-2010-WADONT router presents a critical access control vulnerability that stems from its insecure FTP service implementation. This device, designed for fiber optic network deployment in enterprise and residential environments, suffers from a fundamental flaw in its authentication mechanism that allows unauthorized remote access through default credential exploitation. The vulnerability manifests when the FTP service fails to properly validate user credentials, enabling attackers to establish connections using pre-configured default usernames and passwords without proper authorization. This weakness represents a classic failure in the principle of least privilege and demonstrates poor security engineering practices in the device's network service configuration.
The technical exploitation of this vulnerability follows a straightforward yet dangerous pattern that aligns with common attack vectors documented in the attack mitigation framework. An attacker requires only basic network connectivity to the device and knowledge of the default FTP credentials to establish an unauthorized session. Once connected, the attacker can traverse the device's file system and access sensitive configuration files that contain network settings, administrative credentials, and potentially other confidential data. The underlying flaw resides in the device's failure to implement proper session management and access controls, creating a persistent security gap that persists even after standard network security measures are deployed. This vulnerability directly maps to CWE-284, which describes improper access control in software systems, and reflects the broader category of credential-based attacks that plague network infrastructure devices.
The operational impact of this vulnerability extends far beyond simple unauthorized access, potentially enabling comprehensive network compromise and data exfiltration. Configuration files accessed through this vulnerability may contain administrative passwords, network topology information, and service configurations that could facilitate further attacks against the broader network infrastructure. The device's role in a GPON network environment means that exploitation could provide attackers with insights into the entire fiber network architecture, potentially enabling them to pivot to other connected devices or systems. This vulnerability particularly affects organizations relying on legacy network equipment where default credentials remain unchanged, creating a persistent threat vector that can be exploited without sophisticated techniques or significant resources. The implications align with ATT&CK technique T1078 which covers legitimate credentials use for persistence and privilege escalation.
Mitigation strategies for this vulnerability require immediate implementation of multiple security controls to address both the immediate threat and prevent future exploitation. Network administrators should immediately change default FTP credentials to strong, unique passwords and disable FTP services when not actively required for legitimate network management purposes. The device should be configured to implement proper access controls that enforce authentication requirements and limit access to authorized personnel only. Network segmentation should be implemented to isolate the device from critical network segments, and regular security audits should verify that default credentials have not been retained or re-enabled. Organizations should also consider implementing network monitoring to detect unauthorized FTP connection attempts and establish proper patch management procedures to ensure firmware updates are applied promptly. These measures address the core access control failure while providing additional layers of defense against similar vulnerabilities in the network infrastructure.