CVE-2025-25061 Overview
CVE-2025-25061 is a Confused Deputy vulnerability [CWE-441] affecting JTEKT ELECTRONICS HMI ViewJet C-more series and HMI GC-A2 series Human-Machine Interface (HMI) devices. A remote unauthenticated attacker can abuse the built-in FTP service to perform an FTP bounce attack, using the HMI as an intermediary to relay malicious traffic to third-party systems. The affected devices are commonly deployed in industrial control system (ICS) and operational technology (OT) environments, making the flaw relevant to manufacturing and critical infrastructure operators.
Critical Impact
Attackers can leverage the HMI as a network proxy to reach internal systems, scan protected network segments, or attribute malicious traffic to a trusted OT asset.
Affected Products
- JTEKT ELECTRONICS HMI ViewJet C-more series
- JTEKT ELECTRONICS HMI GC-A2 series
- Industrial control system deployments using the above HMI devices
Discovery Timeline
- 2025-04-04 - CVE-2025-25061 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-25061
Vulnerability Analysis
The vulnerability stems from the FTP server implementation on the affected HMI devices. FTP bounce attacks abuse the PORT command in the FTP protocol, which allows a client to specify an arbitrary IP address and port for the data connection. When an FTP server honors any address supplied in the PORT command without validating that it matches the control connection's origin, the server can be tricked into initiating connections to third-party hosts.
An attacker connects to the HMI's FTP service and issues crafted PORT commands targeting internal or external systems. The HMI then originates TCP traffic toward those targets, effectively acting as a proxy. This allows the attacker to bypass network access controls, perform port scans that appear to originate from the trusted OT device, or deliver traffic to systems that would otherwise be unreachable.
Root Cause
The FTP server on the affected HMI devices does not restrict PORT command arguments to the client's own IP address. This missing validation is the classic enabler of FTP bounce attacks and aligns with the Unintended Proxy or Intermediary weakness described in CWE-441.
Attack Vector
Exploitation requires network reachability to the HMI's FTP service but no authentication or user interaction. The scope is changed because the impacted resource is a third-party system, not the HMI itself. See the JVN Security Advisory JVN17260367 for coordinated disclosure details and the JTEKT Incident Report 202503207269 and JTEKT Incident Report 202503207271 for vendor-specific guidance.
Detection Methods for CVE-2025-25061
Indicators of Compromise
- Outbound TCP connections originating from HMI devices to unexpected internal or external hosts.
- FTP sessions to HMI devices containing PORT commands referencing IP addresses other than the client's source address.
- Anomalous port-scan patterns whose source IP is an HMI in an OT segment.
- Data connections from HMI FTP services to non-standard destinations or high ephemeral ports on internal systems.
Detection Strategies
- Inspect FTP control channel traffic (TCP/21) at the OT/IT boundary and alert on PORT commands whose address argument does not match the FTP client IP.
- Baseline HMI network behavior and flag any device initiating connections outside its normal communication profile.
- Correlate FTP session metadata with subsequent outbound flows from the same HMI within short time windows.
Monitoring Recommendations
- Enable NetFlow or IPFIX collection on switches serving the OT segment to record all HMI-originated flows.
- Deploy ICS-aware intrusion detection sensors that parse the FTP protocol and validate PORT argument consistency.
- Log and retain full FTP command sequences for HMI devices to support forensic review.
How to Mitigate CVE-2025-25061
Immediate Actions Required
- Restrict inbound network access to HMI FTP services using firewall rules that permit only engineering workstations on the OT network.
- Disable the FTP service on the HMI if it is not required for operations.
- Segment HMI devices from corporate networks and the internet in line with IEC 62443 zone-and-conduit guidance.
- Review firewall and switch logs for prior FTP sessions to affected HMIs and investigate any anomalous outbound flows.
Patch Information
Refer to the vendor advisories for firmware updates and remediation status: JTEKT Incident Report 202503207269, JTEKT Incident Report 202503207271, and the coordinated JVN Security Advisory JVN17260367. Operators should confirm applicable firmware versions with JTEKT ELECTRONICS support before deploying updates in production ICS environments.
Workarounds
- Block TCP/21 to HMI devices at the perimeter and any north-south OT firewall.
- Place HMIs behind an application-aware firewall or data diode that rejects FTP PORT commands referencing non-client addresses.
- Use an FTP proxy or jump host for legitimate file transfers to the HMI and disable direct FTP client access from untrusted zones.
- Monitor for and drop egress traffic from HMI devices to any destination outside the approved OT communication matrix.
# Configuration example: restrict FTP access to HMI devices
# Replace with your OT firewall syntax; example uses iptables
iptables -A FORWARD -p tcp -s 10.10.20.0/24 -d 10.20.30.0/24 --dport 21 -j ACCEPT
iptables -A FORWARD -p tcp -d 10.20.30.0/24 --dport 21 -j DROP
# Block egress from HMI segment to non-OT destinations
iptables -A FORWARD -s 10.20.30.0/24 ! -d 10.20.0.0/16 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
