Waveshare RS232/485 to WiFi ETH CVE-2025-63362 Authentication Bypass

Key Information Vulnerability Overview CVE ID: CVE-2025-63362 CVSS v3.1 Base Score: 9.8 (Critical) CVSS v4.0 Base Score: 9.3 (Critical) Concerns: Remotely exploitable / No authentication required Vendor: Waveshare Electronics Device: Waveshare RS232/485 TO WIFI ETH (B) Vulnerability Type: Authentication bypass via blank admin credentials CSAF Document: View CSAF Risk Assessment Any remote attacker can gain full administrative control without credentials. Configuration tampering may disrupt serial routing and industrial communication workflows. Unauthorized users can modify critical network and Wi-Fi settings, enabling further compromise. Operational visibility and security in ICS/IoT environments may be impacted. Technical Details Affected Product Waveshare RS232/485 TO WIFI ETH (B) - Firmware Version: V3.1.1.0 - Hardware Version: 4.3.2.1 - Web Interface: V7.04T.07.002880.0301 Vulnerability Description Endpoint accepts blank admin credential fields. - — Admin username - — Admin password Device performs invalid validation to ensure parameters are non-empty. Attack Scenarios Scenario 1 — Remote Unauthenticated Takeover - Attacker sends request to set blank credentials, then logs in without password. Scenario 2 — Opportunistic Exploitation - If legitimate user misconfigures device (empty credentials), attacker gains full access by simply browsing the Web UI. Scenario 3 — Telnet Control - Once bypassed, if enabled, Telnet access becomes unrestricted, allowing low-level device operations. Mitigation Measures User Recommendations Ensure admin credentials are never left blank. Restrict management access via firewall and VLAN segmentation. Disable Telnet if not required. Follow CISA ICS Security Guidelines: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01 Vendor Recommendations Enforce mandatory non-blank credentials. Block saving empty configuration values. Implement password complexity requirements. Disclosure Timeline September 16, 2025 — Initial report submitted September 23, 2025 — Vendor acknowledgment September 23–27, 2025 — Researcher’s fix request; no timeline provided September 27, 2025 — Notification issued September 29, 2025 — Submitted to MITRE November 10, 2025 — CVE reserved November 11, 2025 — Public disclosure Background This gateway is used for: Industrial automation (PLC/RTU/SCADA serial bridge) IIoT telemetry and sensor networks Remote monitoring systems Embedded development and maker ecosystems Researcher Abhishek Pandey Payatu Security Consulting Pvt. Ltd.

Goal Reached Thanks to every supporter — we hit 100%!

Waveshare RS232/485 to WiFi ETH CVE-2025-63362 Authentication Bypass