Intellian Iridium Certus 700 Multiple Vulnerabilities Advisory (CVE-2025-41377/378/379/380)

Key Vulnerability Information Title Multiple vulnerabilities in Intellian Technologies Iridium Certus Release Date 23/05/2025 Identifier INCIBE-2025-0262 Severity 5 - Critical Affected Resources Iridium Certus 700, version 1.0.1. Description INCIBE coordinated the disclosure of 4 vulnerabilities, including 1 critical, 1 high, and 2 medium-severity issues, affecting Iridium Certus 700, a maritime satellite communication system discovered by Gabriel González Garcia. These vulnerabilities have been assigned the following codes, CVSS v4.0 base scores, CVSS vectors, and CWE vulnerability types: CVE-2025-41377: CVSS v4.0: 9.3 CVE-2025-41378: CVSS v4.0: 6.9 CVE-2025-41379: CVSS v4.0: 6.3 CVE-2025-41380: CVSS v4.0: 4.8 Solution These vulnerabilities have been resolved in versions released by Intellian Technologies in the second quarter of 2025. Details CVE-2025-41377: Encryption vulnerability in Iridium Certus 700. This vulnerability allows users to retrieve encryption keys, leading to malicious firmware loading. CVE-2025-41378: The SSID field is not parsed correctly, enabling command injection into the hostpad.conf file. Attackers can exploit this to gain deeper insight into the system and compromise other devices. Information is filtered through the web panel’s logging feature. CVE-2025-41379: The Intellian C700 web panel allows adding firewall rules. Each rule has an associated ID, but when creating a new rule, the database entry ID may differ from the JSON ID. If a rule needs to be deleted later, the system uses the JSON ID, potentially causing deletion failure. Attackers can exploit this to create rules that cannot be removed unless the device is reset to factory defaults. CVE-2025-41380: Iridium Certus 700 version 1.0.1 contains embedded credentials vulnerability in the code. This allows local users to retrieve SSH hash strings. Reference List Iridium Certus® 700

Goal Reached Thanks to every supporter — we hit 100%!

Intellian Iridium Certus 700 Multiple Vulnerabilities Advisory (CVE-2025-41377/378/379/380)

More from this source