CVE-2025-27615: umatiGateway Information Disclosure Flaw

CVE-2025-27615 Overview

umatiGateway is software for connecting OPC Unified Architecture servers with an MQTT broker utilizing JSON messages. A significant security vulnerability exists in the default docker-compose configuration that may expose the user interface publicly, allowing unauthenticated remote attackers to view and alter gateway configurations.

Critical Impact
Remote attackers can access and modify umatiGateway configurations without authentication, potentially compromising OPC UA to MQTT communications and industrial control system integrations.

Affected Products

umatiGateway (versions prior to commit 5d81a3412bc0051754a3095d89a06d6d743f2b16)
umatiGateway Docker deployments using the default docker-compose file
Systems with Port 8080 exposed to external networks

Discovery Timeline

2025-03-10 - CVE CVE-2025-27615 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-27615

Vulnerability Analysis

This vulnerability falls under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and represents an Insecure Default Configuration issue. The default docker-compose file provided with umatiGateway binds the web interface to all network interfaces rather than restricting it to localhost, making the configuration interface potentially accessible from any network-connected host.

The core issue stems from how Docker handles port binding in the original configuration. When a container port is bound without specifying a specific interface (e.g., using 8080:8080 instead of 127.0.0.1:8080:8080), Docker exposes that port on all available network interfaces, including public-facing ones.

Root Cause

The vulnerability originates from the default docker-compose configuration that did not restrict the web interface binding to the local loopback interface. This insecure default allows the umatiGateway user interface to be accessible from any network that can reach the host on Port 8080. The configuration interface provides full access to view and modify gateway settings without requiring authentication, which compounds the exposure risk.

Attack Vector

An attacker can exploit this vulnerability by identifying publicly accessible umatiGateway instances through network scanning for Port 8080. Once discovered, the attacker can directly access the web interface without any authentication requirement. From there, the attacker can:

View sensitive configuration details including OPC UA server connections and MQTT broker credentials
Modify gateway configurations to redirect or intercept industrial communications
Disable the gateway to cause denial of service to connected systems
Potentially pivot to connected OPC UA servers or MQTT brokers using harvested credentials

A particularly concerning aspect is that Docker's iptables-based rules for port forwarding may bypass host-based firewall rules, meaning that even systems with firewall protections may still be vulnerable if the Docker configuration is not corrected.

Detection Methods for CVE-2025-27615

Indicators of Compromise

Unexpected external connections to Port 8080 on umatiGateway hosts
Configuration changes to umatiGateway that were not authorized by administrators
Anomalous MQTT broker or OPC UA server connection attempts from unexpected sources
Web access logs showing connections from external IP addresses to the umatiGateway interface

Detection Strategies

Perform network scans of your infrastructure to identify any umatiGateway instances with Port 8080 exposed to external networks
Review Docker container configurations to verify port bindings include the 127.0.0.1: prefix
Audit firewall logs for external connection attempts targeting Port 8080
Implement network segmentation monitoring to detect unauthorized access patterns to industrial control networks

Monitoring Recommendations

Configure network intrusion detection systems to alert on external connections to Port 8080 on known umatiGateway hosts
Set up configuration change monitoring for umatiGateway instances to detect unauthorized modifications
Monitor Docker daemon logs for container configuration changes
Implement regular vulnerability scanning that includes Docker configuration audits

How to Mitigate CVE-2025-27615

Immediate Actions Required

Update the docker-compose configuration to bind Port 8080 only to localhost using 127.0.0.1:8080:8080
Review existing umatiGateway configurations for signs of unauthorized modification
Audit network exposure of all umatiGateway instances and ensure they are not publicly accessible
Consider placing umatiGateway behind a reverse proxy with authentication if remote access is required

Patch Information

The fix is available in commit 5d81a3412bc0051754a3095d89a06d6d743f2b16 which modifies the docker-compose configuration to use 127.0.0.1:8080:8080 instead of 8080:8080. This change restricts access to the user interface to only the local machine. For detailed information, refer to the GitHub Security Advisory GHSA-qf9w-x9qx-2mq7 and GitHub Pull Request #101.

Workarounds

Implement firewall rules on Port 8080 to block remote access, though note that Docker may bypass iptables-based rules through its own port forwarding mechanisms
Use Docker network isolation to place umatiGateway in a private network with restricted access
Deploy a VPN requirement for accessing the umatiGateway host
If possible, disable the web interface entirely if configuration management is not actively needed

bash

# Configuration example
# Updated docker-compose.yml port binding to restrict access to localhost only
# Change from:
#   ports:
#     - "8080:8080"
# To:
#   ports:
#     - "127.0.0.1:8080:8080"

# Verify current Docker container port bindings
docker ps --format "table {{.Names}}\t{{.Ports}}"

# Check if port 8080 is externally accessible
netstat -tlnp | grep 8080