CVE-2025-10880: Dingtian DT-R002 Credential Disclosure Flaw

CVE-2025-10880 Overview

CVE-2025-10880 is an Insufficiently Protected Credentials vulnerability affecting all versions of the Dingtian DT-R002 relay controller. This vulnerability allows an unauthenticated attacker to extract the proprietary "Dingtian Binary" protocol password by sending a simple unauthenticated GET request to the device. The exposure of these credentials could enable attackers to gain unauthorized control over the relay device, potentially compromising connected industrial systems and automation infrastructure.

Critical Impact

Unauthenticated attackers can extract protocol passwords via a simple GET request, enabling complete device takeover and potential manipulation of connected relay systems.

Affected Products

• Dingtian-tech DT-R002 Firmware (All versions)
• Dingtian-tech DT-R002 Hardware (All versions)

Discovery Timeline

• 2025-09-25 - CVE-2025-10880 published to NVD
• 2025-09-29 - Last updated in NVD database

Technical Details for CVE-2025-10880

Vulnerability Analysis

This vulnerability stems from a fundamental security design flaw in the Dingtian DT-R002 relay controller's web interface. The device exposes the proprietary "Dingtian Binary" protocol password through an unauthenticated HTTP endpoint. When an attacker sends a crafted GET request to the vulnerable endpoint, the device responds with sensitive credential information without requiring any form of authentication.

The Dingtian Binary protocol is used to communicate with and control the relay device. By obtaining this password, an attacker gains the ability to send arbitrary commands to the relay controller, potentially manipulating connected equipment, disrupting operations, or using the compromised device as a pivot point for further network intrusion.

This vulnerability is classified under CWE-522 (Insufficiently Protected Credentials), which describes scenarios where credentials are stored, transmitted, or exposed in a manner that makes them accessible to unauthorized parties.

Root Cause

The root cause of this vulnerability is the absence of authentication controls on the web endpoint that returns the Dingtian Binary protocol password. The firmware fails to validate whether incoming requests originate from authorized users before disclosing sensitive credential information. This represents a fundamental violation of secure-by-design principles, where sensitive data should always be protected by appropriate authentication and authorization mechanisms.

Attack Vector

The attack vector is network-based and requires no authentication, privileges, or user interaction. An attacker with network access to the DT-R002 device can exploit this vulnerability by:

1. Identifying a DT-R002 device on the network through scanning or reconnaissance
2. Sending an unauthenticated HTTP GET request to the vulnerable endpoint
3. Receiving the Dingtian Binary protocol password in the response
4. Using the extracted credentials to authenticate to the device's proprietary protocol
5. Issuing commands to control relays, modify configurations, or disrupt operations

The vulnerability is particularly concerning in industrial control system (ICS) environments where relay devices may control critical equipment or safety systems.

Detection Methods for CVE-2025-10880

Indicators of Compromise

• Unexpected HTTP GET requests to configuration or credential-related endpoints on DT-R002 devices
• Unauthorized access to the Dingtian Binary protocol from unrecognized IP addresses
• Unusual relay state changes or configuration modifications not initiated by authorized personnel
• Network scanning activity targeting ports commonly used by Dingtian relay devices

Detection Strategies

• Implement network monitoring to detect and alert on unauthenticated HTTP requests to DT-R002 devices
• Deploy intrusion detection signatures to identify exploitation attempts targeting this credential disclosure vulnerability
• Monitor for anomalous command sequences sent via the Dingtian Binary protocol
• Review device logs for authentication attempts from unauthorized sources

Monitoring Recommendations

• Segment DT-R002 devices on isolated network segments with strict access controls and logging
• Implement network flow analysis to detect unexpected communication patterns with relay controllers
• Configure alerts for any external IP addresses attempting to communicate with ICS relay devices
• Establish baseline behavior profiles for normal device operations to identify anomalies

How to Mitigate CVE-2025-10880

Immediate Actions Required

• Isolate all Dingtian DT-R002 devices from untrusted networks immediately
• Implement firewall rules to restrict access to DT-R002 devices to only authorized management hosts
• Place affected devices behind a VPN or secure gateway requiring authentication before network access
• Audit network access logs to determine if exploitation may have already occurred
• Change all Dingtian Binary protocol passwords and monitor for unauthorized access attempts

Patch Information

As of the last NVD update, all versions of the Dingtian DT-R002 firmware are affected. Organizations should consult the CISA ICS Advisory ICSA-25-268-01 for the latest guidance and check with Dingtian-tech for any available firmware updates that address this vulnerability.

Workarounds

• Deploy DT-R002 devices on isolated network segments that are not accessible from untrusted networks
• Use a reverse proxy or application firewall to filter and authenticate all HTTP requests to the device
• Implement VPN access requirements for any remote management of the relay controllers
• Consider replacing vulnerable devices with alternatives that implement proper credential protection if no patch becomes available
• Monitor the CISA advisory for updated remediation guidance

# Example firewall rule to restrict access to DT-R002 devices
# Allow only authorized management hosts (replace with your management IP)
iptables -A INPUT -s 192.168.1.100 -d <DT-R002-IP> -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -d <DT-R002-IP> -p tcp --dport 80 -j DROP