CVE-2025-22450: UD-LT2 Firewall Bypass Vulnerability

CVE-2025-22450 Overview

CVE-2025-22450 affects I-O Data UD-LT2 router firmware version 1.00.008_SE and earlier. The device contains undocumented functionality that a remote, unauthenticated attacker can leverage over the network. Successful exploitation disables the LAN-side firewall function and opens specific ports on the device. The flaw is tracked under CWE-1242: Inclusion of Undocumented Features or Chicken Bits. I-O Data has acknowledged the issue through its support information page and through the JVN Security Advisory.

Critical Impact
A remote attacker can disable the LAN-side firewall on UD-LT2 devices and expose internal services through opened ports without authentication or user interaction.

Affected Products

I-O Data UD-LT2 firmware version 1.00.008_SE
I-O Data UD-LT2 firmware versions earlier than 1.00.008_SE
I-O Data UD-LT2 LTE router hardware shipping with vulnerable firmware

Discovery Timeline

2025-01-22 - CVE-2025-22450 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-22450

Vulnerability Analysis

The UD-LT2 firmware ships with undocumented functionality that bypasses the device's documented security posture. The hidden capability allows a remote attacker to instruct the device to disable its LAN-side firewall enforcement and open specific TCP/UDP ports. Once the firewall is disabled, services that the vendor previously restricted to the LAN interface become reachable from external networks. The flaw is classified under CWE-1242, which covers hidden, debug, or factory functionality that ships in production firmware without disclosure to administrators.

The vulnerability impacts the integrity of the network boundary the device is designed to enforce. Attackers can pivot from the WAN side of the device into LAN-resident systems by reaching services that would normally be blocked by the firewall rules.

Root Cause

The root cause is the inclusion of undocumented features in production firmware. The vendor-shipped code path can be triggered remotely to alter firewall state and listening port configuration. Because the functionality is undocumented, administrators have no method to audit, disable, or detect its presence through normal management interfaces.

Attack Vector

Exploitation occurs over the network and requires no authentication or user interaction. An attacker reaches the device on its exposed interface, triggers the undocumented feature, and the device disables LAN-side firewall enforcement while opening targeted ports. No public proof-of-concept is currently published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detailed technical mechanics are described in the JVN Security Advisory JVN#15293958 and the I-O Data support bulletin.

Detection Methods for CVE-2025-22450

Indicators of Compromise

Unexpected open ports on the WAN or LAN interface of UD-LT2 devices that were not configured by an administrator
Inbound connections from external IP addresses reaching LAN-resident services that should be firewalled
Configuration drift in the UD-LT2 firewall state without a corresponding administrative change record

Detection Strategies

Perform periodic external port scans against UD-LT2 public-facing interfaces and compare results against a known-good baseline
Monitor router logs for firewall rule changes, service restarts, or port-open events that lack a matching administrative session
Correlate netflow or firewall telemetry to identify new ingress flows to LAN hosts following any change in device state

Monitoring Recommendations

Forward syslog data from UD-LT2 devices to a centralized logging platform for retention and alerting
Alert on any change to the firewall enable/disable status and on new listening sockets on the device
Track WAN-side connection attempts to non-standard ports and review for patterns consistent with reconnaissance against the device

How to Mitigate CVE-2025-22450

Immediate Actions Required

Update UD-LT2 firmware to a version later than 1.00.008_SE as published by I-O Data
Restrict management and inbound access to UD-LT2 devices using upstream network ACLs until patched
Inventory all UD-LT2 deployments and confirm firmware versions across the fleet

Patch Information

I-O Data has published remediation guidance on the official UD-LT2 support page. Administrators should apply the vendor-supplied firmware update that addresses the undocumented feature. Refer to JVN#15293958 for the coordinated advisory and fixed version details.

Workarounds

Place UD-LT2 devices behind an upstream firewall that blocks unsolicited inbound traffic from untrusted networks
Disable WAN-side reachability for any service that is not strictly required for operation
Segment LAN hosts so that a firewall bypass on the UD-LT2 does not expose sensitive internal systems directly

bash

# Configuration example: upstream ACL restricting inbound traffic to the UD-LT2 WAN interface
# Replace <UD-LT2-WAN-IP> and <ADMIN-NET> with values for your environment
iptables -A FORWARD -d <UD-LT2-WAN-IP> -s <ADMIN-NET> -j ACCEPT
iptables -A FORWARD -d <UD-LT2-WAN-IP> -j DROP