CVE-2025-67112 in SCE4255W
Summary
by MITRE • 03/19/2026
Use of a hard-coded AES-256-CBC key in the configuration backup/restore implementation of Small Cell Sercomm SCE4255W (FreedomFi Englewood) firmware before DG3934v3@2308041842 allows remote authenticated users to decrypt, modify, and re-encrypt device configurations, enabling credential manipulation and privilege escalation via the GUI import/export functions.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 03/24/2026
The vulnerability identified as CVE-2025-67112 represents a critical security flaw in the Small Cell Sercomm SCE4255W device firmware, specifically affecting versions prior to DG3934v3@2308041842. This issue manifests within the configuration backup and restore functionality, where a hard-coded AES-256-CBC encryption key is embedded within the device's firmware implementation. The presence of such a hard-coded cryptographic key fundamentally undermines the security posture of the device, creating a persistent backdoor that can be exploited by authenticated attackers who possess legitimate access credentials.
The technical implementation of this vulnerability stems from a failure to properly manage cryptographic keys within the device's configuration management system. When users perform backup or restore operations through the graphical user interface, the system utilizes a static encryption key that remains unchanged across all device instances. This approach directly violates security best practices outlined in the OWASP Top Ten and NIST guidelines for cryptographic key management. The hard-coded nature of the key means that any individual who can authenticate to the device's web interface can leverage this knowledge to decrypt configuration files, modify sensitive parameters, and re-encrypt the modified data using the same predictable key.
The operational impact of this vulnerability extends beyond simple configuration manipulation to encompass broader privilege escalation and credential manipulation capabilities. An authenticated attacker can exploit this weakness to modify administrative credentials, alter network configurations, and potentially gain persistent access to the device. The ability to decrypt and re-encrypt configuration data enables attackers to create malicious configuration files that can be imported back into the system, effectively allowing for privilege escalation attacks. This vulnerability aligns with the CWE-327 weakness category related to use of a broken or weak cryptographic algorithm, and it maps to ATT&CK technique T1547.001 for registry run keys and startup folder, as attackers could modify configuration files to establish persistence mechanisms.
The implications of this vulnerability are particularly severe for network infrastructure devices like the Sercomm SCE4255W, which serves as a critical component in cellular network deployments. Attackers who can authenticate to the device's GUI can essentially take complete control of the configuration management system, potentially compromising the entire network segment that relies on this small cell device. The remote nature of the attack vector means that exploitation does not require physical access to the device, making it particularly dangerous in deployed environments. Organizations should immediately implement mitigations including firmware updates to the patched version DG3934v3@2308041842, network segmentation to limit access to these devices, and monitoring for unusual configuration changes that might indicate exploitation attempts. Additionally, the vulnerability highlights the importance of proper key management practices and the necessity of avoiding hard-coded cryptographic materials in embedded systems and network appliances.