CVE-2025-57176

MEDIUM

Siklu EtherHaul Series EH-8010 - Arbitrary File Upload

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-57176 has a selected CVSS score of 6.5 (medium); EIP currently links 1 catalogued exploit and 1 repository PoC.

Description

On Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpiped service on TCP port 555 allows unauthenticated file uploads to any writable location on the device. File upload packets use weak encryption (metadata only) with file contents transmitted in cleartext. No authentication or path validation is performed.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 15, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

EtherHaul and MultiHaul Series microwave antennas

Browse Ceragon Networks / Siklu Communication / EtherHaul and MultiHaul Series microwave antennas

Default status: unaffected

CVE ListCeragon MultiHaul MH-B100-CCS to < R2.4.0affected
Ceragon MultiHaul MH-T200-CCC to < R2.4.0affected
Ceragon MultiHaul MH-T200-CNN to < R2.4.0affected
Ceragon MultiHaul MH-T201-CNN to < R2.4.0affected
Ceragon EtherHaul EH-8010FX to < R10.8.1affected
Ceragon EtherHaul EH-500TX to < R7.7.12affected
Ceragon EtherHaul EH-600TX to < R7.7.12affected
Ceragon EtherHaul EH-614TX to < R7.7.12affected
Ceragon EtherHaul EH-700TX to < R7.7.12affected
Ceragon EtherHaul EH-710TX to < R7.7.12affected
Ceragon EtherHaul EH-1200TX to < R7.7.12affected
Ceragon EtherHaul EH-1200FX to < R7.7.12affected
Showing 12 of 15 version ranges

Proofs of concept

2

Catalogued exploits

ExploitDBSiklu EtherHaul Series EH-8010 - Arbitrary File UploadExploitDB exploitby semaja2Exploit1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that connects to TCP port 555, constructs a file upload header with a user-supplied remote path, and sends a local file as the payload using the rfpiped protocol with hardcoded AES-CBC keys. It performs an unauthenticated arbitrary file upload against Siklu EtherHaul devices.

Backdoor review

No backdoor observed in reviewed code

The supplied Python script implements a client for the CVE-2025-57176 arbitrary file upload vulnerability. It constructs a protocol header, encrypts it with a hardcoded AES key, sends it along with a user-supplied file payload to a target on TCP port 555, and optionally prints the server response. No backdoor, deceptive payload, or concealed operator-directed harm is present.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareSiklu EtherHaul Seriesrfpiped service
Attack typesarbitrary file upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively uploads an arbitrary file to a remote path on the target device via the rfpiped protocol. It does not merely detect or report the vulnerability; it performs the file write operation, which is the exploitation action described in CVE-2025-57176.

exploits/multiple/webapps/52467.py:1-10exploits/multiple/webapps/52467.py:96-131

Requirements

  • Target device must run the rfpiped service on TCP port 555.exploits/multiple/webapps/52467.py:16
  • Attacker must know the hardcoded AES key and IV used by the rfpiped protocol.exploits/multiple/webapps/52467.py:18-24

Observed behavior

  • Connects to the target on TCP port 555.exploits/multiple/webapps/52467.py:83-94exploits/multiple/webapps/52467.py:110
  • Builds a protocol header containing a user-supplied remote file path and the payload length.exploits/multiple/webapps/52467.py:42-51exploits/multiple/webapps/52467.py:106-107
  • Encrypts the header and payload using AES-CBC with hardcoded key and IV, then sends them to the target.exploits/multiple/webapps/52467.py:58-62exploits/multiple/webapps/52467.py:111-113
  • Optionally receives and decrypts a response from the server.exploits/multiple/webapps/52467.py:114-128
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Hardcoded Key
Payload withheldThe script contains a hardcoded AES-256 key used for encrypting protocol traffic. This is part of the documented vulnerability (weak encryption) and is required for the exploit to function; it does not constitute a backdoor.exploits/multiple/webapps/52467.py:19-24
Hardcoded Iv
Payload withheldThe script contains a hardcoded initialization vector for AES-CBC. This is part of the documented vulnerability and is required for the exploit to function.exploits/multiple/webapps/52467.py:18
Network Connection
Payload withheldThe script connects to a user-specified target on port 555, which is the documented vulnerable service. This is the intended exploit behavior.exploits/multiple/webapps/52467.py:16exploits/multiple/webapps/52467.py:110
File Upload
Payload withheldThe script reads a local file specified by the user and sends it to the target device. This is the core of the arbitrary file upload exploit.exploits/multiple/webapps/52467.py:104-105exploits/multiple/webapps/52467.py:112-113
Review boundaries

What the analysis did not establish

  • Only the exploit script was analyzed; external libraries (e.g., pycryptodome) and referenced resources were not expanded.
  • The script's behavior was inferred from static code analysis; it was not executed, so runtime behavior is not confirmed.
  • The script's effectiveness depends on the target device's firmware version and configuration, which were not verified.
  • Only the supplied text file (52467.py) was reviewed. No external dependencies (e.g., pycryptodome) or referenced resources were inspected.
  • Binary content, if any, was not analyzed per the evidence policy.
  • The review does not assess the safety or correctness of the exploit when executed against a target.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Repository PoCs

GitHubsemaja22/CVE-2025-57176Repository PoCby semaja220Exploit2 files

4.6 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that connects to the rfpiped service on TCP port 555, constructs an encrypted header specifying a file upload (msg 0x04), and sends a local file as the payload, achieving unauthenticated arbitrary file upload on Ceragon/Siklu microwave antennas.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python script (CVE-2025-57176.py) and a README.md file. The script implements a client for the rfpiped service on TCP port 555, performing an unauthenticated file upload as described in CVE-2025-57176. It uses hardcoded AES key and IV to encrypt/decrypt protocol headers and payloads, constructs a header with a specified remote path, and sends a local file as the payload. The script optionally receives and prints a server response. No backdoor, deceptive payload, or concealed operator-directed harm is present. The code is a straightforward proof-of-concept exploit for the stated vulnerability.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareCeragon Networks EtherHaul SeriesSiklu Communication MultiHaul Seriesrfpiped service
Attack typesarbitrary file upload
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively connects to a vulnerable service, constructs a file upload message, and transmits a local file to the target, which constitutes exploitation rather than mere detection or scanning.

CVE-2025-57176.py:1CVE-2025-57176.py:87-122

Requirements

  • Network access to target device on TCP port 555CVE-2025-57176.py:7
  • Knowledge of hardcoded AES key and IVCVE-2025-57176.py:9-15
  • Local file to uploadCVE-2025-57176.py:91

Observed behavior

  • Connects to target on TCP port 555 using IPv4 or IPv6CVE-2025-57176.py:74-85
  • Builds a 0x90-byte header with flag 0x00, message type 0x04 (file upload), payload length, and a user-supplied remote pathCVE-2025-57176.py:33-42CVE-2025-57176.py:98
  • Encrypts the header and payload using AES-CBC with a hardcoded key and IV, then sends them to the serviceCVE-2025-57176.py:49-53CVE-2025-57176.py:100-104
  • Optionally receives and decrypts the server responseCVE-2025-57176.py:105-119
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Hardcoded Key
Payload withheldThe script contains a hardcoded AES key and IV used to encrypt/decrypt protocol messages. This is consistent with the CVE description of weak encryption and is necessary for the exploit to function.CVE-2025-57176.py:9-15
Network Connection
Payload withheldThe script connects to the target on port 555, matching the CVE description of the vulnerable rfpiped service.CVE-2025-57176.py:7CVE-2025-57176.py:101
File Upload
Payload withheldThe script reads a local file and sends it as the payload of a message with msg=0x04, implementing the arbitrary file upload exploit.CVE-2025-57176.py:95-104
Review boundaries

What the analysis did not establish

  • Evidence consists solely of the Python script and README; no network captures, build artifacts, or execution logs are provided.
  • The script's effectiveness depends on the target running the vulnerable rfpiped service and accepting the hardcoded cryptographic material.
  • The README is minimal and does not provide additional technical detail beyond affected version ranges.
  • Only the two text files (CVE-2025-57176.py and README.md) were provided and reviewed. No binary files or other repository content were inspected.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

4