CVE-2025-13658: Longwatch Devices RCE Vulnerability

CVE-2025-13658 Overview

A critical vulnerability exists in Longwatch devices that allows unauthenticated attackers to execute arbitrary code via specially crafted HTTP GET requests. The vulnerability stems from an exposed endpoint combined with the absence of code signing and execution controls, enabling attackers to achieve SYSTEM-level privileges without any authentication.

This Remote Code Execution (RCE) vulnerability represents a severe risk to industrial control system (ICS) environments where Longwatch devices are deployed. The network-accessible nature of the attack vector, combined with no authentication requirements and SYSTEM-level privilege escalation, makes this vulnerability particularly dangerous for critical infrastructure.

Critical Impact

Unauthenticated remote attackers can execute arbitrary code with SYSTEM-level privileges on vulnerable Longwatch devices, potentially compromising entire ICS environments.

Affected Products

• Longwatch devices (specific versions not disclosed in advisory)

Discovery Timeline

• 2025-12-02 - CVE-2025-13658 published to NVD
• 2025-12-04 - Last updated in NVD database

Technical Details for CVE-2025-13658

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code - Code Injection), a weakness that occurs when software constructs all or part of a code segment using externally-influenced input without properly neutralizing special elements that could modify the intended code behavior.

The vulnerable Longwatch devices expose an HTTP endpoint that processes incoming GET requests without proper authentication or authorization controls. Additionally, the devices lack code signing mechanisms and execution controls that would typically prevent unauthorized code from running on the system.

The absence of these fundamental security controls creates a direct path for attackers to inject and execute malicious code. When exploitation is successful, the attacker gains SYSTEM-level privileges, representing the highest level of access on Windows-based systems.

Root Cause

The root cause of this vulnerability is a combination of missing security controls:

1. Missing Authentication: The vulnerable HTTP endpoint does not require any form of authentication, allowing any network-accessible attacker to send requests.

2. Absent Code Signing: The device does not implement code signing verification, meaning it cannot distinguish between legitimate firmware/code and malicious payloads.

3. No Execution Controls: Without proper execution controls or sandboxing, any code that reaches the execution path runs with full system privileges.

These architectural weaknesses are common in legacy ICS devices that were designed before modern security practices became standard.

Attack Vector

The attack is network-based and requires no user interaction or prior authentication. An attacker with network access to the vulnerable Longwatch device can send a malicious HTTP GET request to the exposed endpoint. The request payload contains arbitrary code that the device executes without validation, resulting in SYSTEM-level compromise.

The attack flow typically involves:

1. Network reconnaissance to identify Longwatch devices
2. Crafting a malicious HTTP GET request targeting the vulnerable endpoint
3. Including arbitrary code within the request parameters
4. The device processes and executes the code with SYSTEM privileges

Due to the sensitive nature of this ICS vulnerability and the absence of verified proof-of-concept code, specific exploitation details are not provided. Technical details can be found in the CISA ICS Advisory ICSA-25-336-01.

Detection Methods for CVE-2025-13658

Indicators of Compromise

• Unusual HTTP GET requests to Longwatch device endpoints from unexpected source IP addresses
• Unexpected processes spawning with SYSTEM privileges on Longwatch devices
• Anomalous outbound network connections from Longwatch devices indicating potential command-and-control communication
• Log entries showing access to administrative endpoints without corresponding authentication events

Detection Strategies

• Monitor network traffic for HTTP GET requests to Longwatch devices, particularly those containing suspicious payload patterns or encoded commands
• Implement network intrusion detection rules to identify exploitation attempts targeting exposed Longwatch endpoints
• Deploy behavioral analysis to detect anomalous process execution or privilege escalation on ICS devices
• Review system logs for unauthorized code execution or unexpected service modifications

Monitoring Recommendations

• Establish baseline network behavior for Longwatch devices and alert on deviations
• Implement continuous monitoring of HTTP traffic to and from ICS devices using industrial-grade network monitoring solutions
• Deploy SentinelOne Singularity for endpoint detection on compatible systems to identify post-exploitation activities
• Enable verbose logging on network firewalls and ICS-specific security monitoring tools

How to Mitigate CVE-2025-13658

Immediate Actions Required

• Isolate vulnerable Longwatch devices from direct network access by placing them behind properly configured firewalls
• Implement network segmentation to restrict access to ICS devices from trusted management networks only
• Disable or block external HTTP access to Longwatch devices until patches are available
• Conduct an inventory assessment to identify all Longwatch devices in your environment

Patch Information

Organizations should refer to the CISA ICS Advisory ICSA-25-336-01 for the latest vendor patch information and remediation guidance. Contact Longwatch directly for firmware updates addressing this vulnerability.

SentinelOne customers benefit from proactive threat intelligence and behavioral detection capabilities that can identify exploitation attempts and post-compromise activities associated with this vulnerability.

Workarounds

• Implement strict network access controls using firewalls to limit HTTP access to Longwatch devices to authorized management stations only
• Deploy a web application firewall (WAF) in front of Longwatch devices to filter malicious HTTP requests
• Use VPN or other secure remote access solutions for any required external access to ICS environments
• Enable network monitoring and logging for all traffic to/from Longwatch devices to aid in incident detection and response

# Example firewall rule to restrict Longwatch device access (adjust IP ranges as needed)
# Allow only trusted management network
iptables -A INPUT -s 10.10.0.0/24 -d <LONGWATCH_IP> -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -d <LONGWATCH_IP> -p tcp --dport 80 -j DROP