CVE-2025-10879: Dingtian DT-R002 Credentials Vulnerability

CVE-2025-10879 Overview

CVE-2025-10879 affects all firmware versions of the Dingtian DT-R002 relay controller. The device exposes the current user's username to unauthenticated network requests, classified under [CWE-522] Insufficiently Protected Credentials. An attacker with network access to the device can retrieve credential information without providing any authentication material.

The vulnerability was disclosed through CISA ICS Advisory ICSA-25-268-01. The DT-R002 is an industrial relay controller used in operational technology environments, which increases the exposure risk when devices are reachable from untrusted networks.

Critical Impact
Unauthenticated attackers can harvest valid usernames from exposed DT-R002 devices, providing the first stage for credential-based attacks against industrial control system assets.

Affected Products

Dingtian DT-R002 hardware (all hardware revisions)
Dingtian DT-R002 firmware (all versions)
CPE: cpe:2.3:o:dingtian-tech:dt-r002_firmware:*:*:*:*:*:*:*:*

Discovery Timeline

2025-09-25 - CVE-2025-10879 published to NVD
2025-09-25 - CISA publishes ICS Advisory ICSA-25-268-01
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10879

Vulnerability Analysis

The DT-R002 web management interface exposes username information through an endpoint that does not enforce authentication. Under [CWE-522], credentials or credential-related data are transmitted or stored using methods that fail to protect them against unauthorized retrieval.

In this case, the device responds to unauthenticated HTTP requests with the configured username of the current user. This transforms username discovery from a guessing problem into a direct query, removing a fundamental obstacle for downstream authentication attacks.

The attack is remote and requires no user interaction or privileges. Exploitation succeeds against any network-reachable DT-R002, whether directly exposed on the internet or accessible from a compromised network segment.

Root Cause

The root cause is missing authorization on an endpoint that returns account metadata. The device's HTTP interface treats username disclosure as non-sensitive and serves the value to any caller. This design decision violates the principle that any data linked to an account, including identifiers, requires authenticated access.

Attack Vector

Exploitation requires only network reachability to the DT-R002 management interface. An attacker sends a crafted HTTP request to the vulnerable endpoint and parses the response for the username value. The disclosed username can then be used to:

Seed credential stuffing attacks against the device login
Correlate DT-R002 accounts with credentials leaked in third-party breaches
Perform targeted password spraying with realistic username input
Enumerate operators for social engineering against ICS personnel

Because the DT-R002 is an industrial relay controller, successful follow-on authentication can permit an attacker to actuate physical relays and disrupt connected equipment.

Detection Methods for CVE-2025-10879

Indicators of Compromise

Unauthenticated HTTP GET requests to DT-R002 management endpoints from external or unexpected internal source addresses
Repeated login attempts on DT-R002 devices following username enumeration traffic
HTTP responses from DT-R002 devices containing account identifier fields to unauthenticated sessions
Scanner user agents or empty user agent strings querying DT-R002 web interfaces

Detection Strategies

Deploy network intrusion detection signatures that alert on unauthenticated requests to DT-R002 management URLs
Monitor OT network segments for HTTP traffic to Dingtian devices originating from IT networks or the internet
Correlate username disclosure requests with subsequent authentication attempts on the same device within short time windows
Baseline expected engineering workstation communications with DT-R002 devices and alert on deviations

Monitoring Recommendations

Log all HTTP requests to DT-R002 management interfaces at the network boundary between IT and OT zones
Track authentication failure rates on DT-R002 devices and alert on spikes indicative of credential stuffing
Inventory internet-exposed DT-R002 devices using external attack surface scanning
Capture full-packet data for traffic to industrial control endpoints for retrospective analysis

How to Mitigate CVE-2025-10879

Immediate Actions Required

Remove DT-R002 devices from direct internet exposure and restrict access to trusted engineering hosts
Place DT-R002 devices behind a firewall or VPN and enforce source IP allow-listing on the management interface
Rotate DT-R002 account passwords and, where supported, change default usernames to non-obvious values
Review authentication logs on all DT-R002 devices for signs of credential stuffing or brute force activity

Patch Information

No vendor firmware patch is referenced in the CISA advisory at the time of publication. Consult the CISA ICS Advisory ICSA-25-268-01 and the Dingtian vendor support channels for updated firmware availability. Until a patch is issued, compensating network controls are the primary defense.

Workarounds

Segment DT-R002 devices into a dedicated OT VLAN with strict ingress filtering per CISA ICS defense-in-depth guidance
Terminate remote administrative access through a VPN or jump host that requires multi-factor authentication
Disable the DT-R002 web management interface on devices that can be operated through alternative protocols
Apply network access control lists to permit management traffic only from designated engineering workstations

bash

# Example iptables rules restricting DT-R002 management access
# Replace 10.20.30.40 with the DT-R002 device IP
# Replace 10.20.30.10 with the authorized engineering workstation IP
iptables -A FORWARD -s 10.20.30.10 -d 10.20.30.40 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 10.20.30.40 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 10.20.30.40 -p tcp --dport 443 -j DROP