CVE-2025-27615: umatiGateway Information Disclosure Flaw

CVE-2025-27615 Overview

umatiGateway is software for connecting OPC Unified Architecture servers with an MQTT broker utilizing JSON messages. A significant security vulnerability exists in the default docker-compose configuration that may expose the user interface publicly, allowing unauthenticated remote attackers to view and alter gateway configurations.

Critical Impact

Remote attackers can access and modify umatiGateway configurations without authentication, potentially compromising OPC UA to MQTT communications and industrial control system integrations.

Affected Products

• umatiGateway (versions prior to commit 5d81a3412bc0051754a3095d89a06d6d743f2b16)
• umatiGateway Docker deployments using the default docker-compose file
• Systems with Port 8080 exposed to external networks

Discovery Timeline

• 2025-03-10 - CVE CVE-2025-27615 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-27615

Vulnerability Analysis

This vulnerability falls under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and represents an Insecure Default Configuration issue. The default docker-compose file provided with umatiGateway binds the web interface to all network interfaces rather than restricting it to localhost, making the configuration interface potentially accessible from any network-connected host.

The core issue stems from how Docker handles port binding in the original configuration. When a container port is bound without specifying a specific interface (e.g., using 8080:8080 instead of 127.0.0.1:8080:8080), Docker exposes that port on all available network interfaces, including public-facing ones.

Root Cause

The vulnerability originates from the default docker-compose configuration that did not restrict the web interface binding to the local loopback interface. This insecure default allows the umatiGateway user interface to be accessible from any network that can reach the host on Port 8080. The configuration interface provides full access to view and modify gateway settings without requiring authentication, which compounds the exposure risk.

Attack Vector

An attacker can exploit this vulnerability by identifying publicly accessible umatiGateway instances through network scanning for Port 8080. Once discovered, the attacker can directly access the web interface without any authentication requirement. From there, the attacker can:

1. View sensitive configuration details including OPC UA server connections and MQTT broker credentials
2. Modify gateway configurations to redirect or intercept industrial communications
3. Disable the gateway to cause denial of service to connected systems
4. Potentially pivot to connected OPC UA servers or MQTT brokers using harvested credentials

A particularly concerning aspect is that Docker's iptables-based rules for port forwarding may bypass host-based firewall rules, meaning that even systems with firewall protections may still be vulnerable if the Docker configuration is not corrected.

Detection Methods for CVE-2025-27615

Indicators of Compromise

• Unexpected external connections to Port 8080 on umatiGateway hosts
• Configuration changes to umatiGateway that were not authorized by administrators
• Anomalous MQTT broker or OPC UA server connection attempts from unexpected sources
• Web access logs showing connections from external IP addresses to the umatiGateway interface

Detection Strategies

• Perform network scans of your infrastructure to identify any umatiGateway instances with Port 8080 exposed to external networks
• Review Docker container configurations to verify port bindings include the 127.0.0.1: prefix
• Audit firewall logs for external connection attempts targeting Port 8080
• Implement network segmentation monitoring to detect unauthorized access patterns to industrial control networks

Monitoring Recommendations

• Configure network intrusion detection systems to alert on external connections to Port 8080 on known umatiGateway hosts
• Set up configuration change monitoring for umatiGateway instances to detect unauthorized modifications
• Monitor Docker daemon logs for container configuration changes
• Implement regular vulnerability scanning that includes Docker configuration audits

How to Mitigate CVE-2025-27615

Immediate Actions Required

• Update the docker-compose configuration to bind Port 8080 only to localhost using 127.0.0.1:8080:8080
• Review existing umatiGateway configurations for signs of unauthorized modification
• Audit network exposure of all umatiGateway instances and ensure they are not publicly accessible
• Consider placing umatiGateway behind a reverse proxy with authentication if remote access is required

Patch Information

The fix is available in commit 5d81a3412bc0051754a3095d89a06d6d743f2b16 which modifies the docker-compose configuration to use 127.0.0.1:8080:8080 instead of 8080:8080. This change restricts access to the user interface to only the local machine. For detailed information, refer to the GitHub Security Advisory GHSA-qf9w-x9qx-2mq7 and GitHub Pull Request #101.

Workarounds

• Implement firewall rules on Port 8080 to block remote access, though note that Docker may bypass iptables-based rules through its own port forwarding mechanisms
• Use Docker network isolation to place umatiGateway in a private network with restricted access
• Deploy a VPN requirement for accessing the umatiGateway host
• If possible, disable the web interface entirely if configuration management is not actively needed

# Configuration example
# Updated docker-compose.yml port binding to restrict access to localhost only
# Change from:
#   ports:
#     - "8080:8080"
# To:
#   ports:
#     - "127.0.0.1:8080:8080"

# Verify current Docker container port bindings
docker ps --format "table {{.Names}}\t{{.Ports}}"

# Check if port 8080 is externally accessible
netstat -tlnp | grep 8080