Siklu EtherHaul 8010 Firmware Decryption & CVE-2025-57175 Exploitation

Vulnerability Overview This article details security vulnerabilities in the firmware of the Siklu EtherHaul 8010 device. 1. Physical Access and UART Acquisition: Attackers can physically disassemble the device to locate the UART interface (pins J7 and J83) and gain device access via a UART-to-TTL-to-USB adapter. 2. Shell Access and Credential Exposure: The device uses U-Boot for booting and runs a Linux system. Attackers can log in using a static root password leaked in a known vulnerability (CVE-2025-57175). 3. Firmware Decryption and Key Extraction: During the firmware update process, a process named is responsible for decrypting the firmware. Attackers successfully captured the 32-byte decryption key by intercepting the standard input (stdin) of the command invoked by this process (the first 16 bytes are static, while the last 16 bytes change dynamically). 4. Firmware Structure Analysis: The firmware image ends with 48 bytes used for signature verification and CRC32 checks. After removing these 48 bytes, the remaining portion contains a 16-byte key used for decryption. Scope of Impact Affected Devices: Siklu EtherHaul 8010 Affected Components: Firmware update mechanism ( ), UART interface, default root password. Remediation and Exploitation Code The author provides a Python script logic to decrypt the firmware for reverse engineering purposes. Script Logic Description: 1. Extract the image key from the file (read the last 16 bytes from the last 32 bytes of the image). 2. Copy the image file and trim off the last 48 bytes. 3. Launch the process, passing the master key and the image key. Relevant Code Snippet (from the bottom of the page): Usage (Example):

Goal Reached Thanks to every supporter — we hit 100%!

Siklu EtherHaul 8010 Firmware Decryption & CVE-2025-57175 Exploitation