Siklu EtherHaul Series EH-8010 - Arbitrary File Upload

ExploitDBExploitDB exploitExploitEDB-52467

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that connects to TCP port 555, constructs a file upload header with a user-supplied remote path, and sends a local file as the payload using the rfpiped protocol with hardcoded AES-CBC keys. It performs an unauthenticated arbitrary file upload against Siklu EtherHaul devices.

Backdoor review

No backdoor observed in reviewed code

The supplied Python script implements a client for the CVE-2025-57176 arbitrary file upload vulnerability. It constructs a protocol header, encrypts it with a hardcoded AES key, sends it along with a user-supplied file payload to a target on TCP port 555, and optionally prints the server response. No backdoor, deceptive payload, or concealed operator-directed harm is present.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareSiklu EtherHaul Seriesrfpiped service
Attack typesarbitrary file upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively uploads an arbitrary file to a remote path on the target device via the rfpiped protocol. It does not merely detect or report the vulnerability; it performs the file write operation, which is the exploitation action described in CVE-2025-57176.

exploits/multiple/webapps/52467.py:1-10exploits/multiple/webapps/52467.py:96-131

Requirements

  • Target device must run the rfpiped service on TCP port 555.exploits/multiple/webapps/52467.py:16
  • Attacker must know the hardcoded AES key and IV used by the rfpiped protocol.exploits/multiple/webapps/52467.py:18-24

Observed behavior

  • Connects to the target on TCP port 555.exploits/multiple/webapps/52467.py:83-94exploits/multiple/webapps/52467.py:110
  • Builds a protocol header containing a user-supplied remote file path and the payload length.exploits/multiple/webapps/52467.py:42-51exploits/multiple/webapps/52467.py:106-107
  • Encrypts the header and payload using AES-CBC with hardcoded key and IV, then sends them to the target.exploits/multiple/webapps/52467.py:58-62exploits/multiple/webapps/52467.py:111-113
  • Optionally receives and decrypts a response from the server.exploits/multiple/webapps/52467.py:114-128
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Hardcoded Key
89E7FFBEEB2D73F5A910FC425B1F36179FB95E7535A342A05D0248B119D24B82The script contains a hardcoded AES-256 key used for encrypting protocol traffic. This is part of the documented vulnerability (weak encryption) and is required for the exploit to function; it does not constitute a backdoor.exploits/multiple/webapps/52467.py:19-24
Hardcoded Iv
EA703B8275A9A17B1DFC7BB955A24D72The script contains a hardcoded initialization vector for AES-CBC. This is part of the documented vulnerability and is required for the exploit to function.exploits/multiple/webapps/52467.py:18
Network Connection
TCP port 555 to user-supplied targetThe script connects to a user-specified target on port 555, which is the documented vulnerable service. This is the intended exploit behavior.exploits/multiple/webapps/52467.py:16exploits/multiple/webapps/52467.py:110
File Upload
User-supplied local file sent as payload to remote pathThe script reads a local file specified by the user and sends it to the target device. This is the core of the arbitrary file upload exploit.exploits/multiple/webapps/52467.py:104-105exploits/multiple/webapps/52467.py:112-113
Review boundaries

What the analysis did not establish

  • Only the exploit script was analyzed; external libraries (e.g., pycryptodome) and referenced resources were not expanded.
  • The script's behavior was inferred from static code analysis; it was not executed, so runtime behavior is not confirmed.
  • The script's effectiveness depends on the target device's firmware version and configuration, which were not verified.
  • Only the supplied text file (52467.py) was reviewed. No external dependencies (e.g., pycryptodome) or referenced resources were inspected.
  • Binary content, if any, was not analyzed per the evidence policy.
  • The review does not assess the safety or correctness of the exploit when executed against a target.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1