CVE-2025-27722 Overview
CVE-2025-27722 is a cleartext transmission of sensitive information vulnerability [CWE-319] affecting the Inaba Denki Sangyo Wi-Fi AP UNIT AC-WPS-11ac series. The device transmits authentication data without encryption, exposing credentials to network observers. A remote unauthenticated attacker positioned to perform a man-in-the-middle (MITM) attack can eavesdrop on the communication and obtain authentication information. Exploitation requires network positioning between the client and the access point, which raises attack complexity but remains feasible on shared or untrusted networks.
Critical Impact
A successful MITM attack yields authentication credentials for the affected Wi-Fi access point, enabling further unauthorized access to the managed wireless infrastructure.
Affected Products
- Inaba Denki Sangyo Wi-Fi AP UNIT AC-WPS-11ac series
- Refer to the Inaba Security Document for the full list of affected model numbers
- See the JVN Security Advisory for coordinated disclosure details
Discovery Timeline
- 2025-04-09 - CVE-2025-27722 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-27722
Vulnerability Analysis
The vulnerability stems from the access point transmitting sensitive authentication information in cleartext over the network. Because the protocol does not enforce transport-layer encryption for these exchanges, any adversary with a network vantage point can capture the traffic. The confidentiality impact is significant, while integrity and availability remain unaffected. Exploitation depends on the attacker's ability to intercept or relay traffic between the client and the AC-WPS-11ac series device. Public exploit code is not currently available, and the Exploit Prediction Scoring System indicates a low probability of near-term exploitation.
Root Cause
The root cause is the absence of encryption for authentication traffic on the affected Wi-Fi AP UNIT. Sensitive fields are serialized and sent over the wire without TLS or equivalent transport protection, matching the pattern described in [CWE-319]. Any intermediary device or attacker on the same broadcast domain can read the credentials.
Attack Vector
The attack vector is network-based and requires no privileges or user interaction. An attacker performs a MITM attack against the management or authentication channel of the access point. Common techniques include ARP spoofing on a shared LAN, rogue access point deployment, or upstream network interception. Captured authentication information can then be replayed or reused to gain access to the wireless management plane.
No verified exploit code has been released. Technical specifics are documented in the vendor advisory referenced above.
Detection Methods for CVE-2025-27722
Indicators of Compromise
- Unexpected ARP table changes or duplicate MAC addresses on network segments serving AC-WPS-11ac series devices
- Cleartext HTTP or unencrypted management traffic captured to or from the access point IP
- Successful administrative logins from unfamiliar source addresses following network anomalies
Detection Strategies
- Inspect network captures for unencrypted authentication payloads originating from the affected devices
- Deploy network intrusion detection rules that flag plaintext credential patterns on ports used by the AP management interface
- Correlate authentication events on the access point with rogue device or ARP anomaly alerts
Monitoring Recommendations
- Continuously monitor management VLANs for cleartext protocols and unauthorized listeners
- Alert on new devices joining segments that carry access point administration traffic
- Track configuration changes and administrative logins on the AC-WPS-11ac series units
How to Mitigate CVE-2025-27722
Immediate Actions Required
- Apply the firmware update published in the Inaba Security Document as soon as it is available for your model
- Rotate administrative credentials for any AC-WPS-11ac series device that has been in production use
- Restrict management access to a dedicated, isolated VLAN with strict access control lists
Patch Information
Inaba Denki Sangyo has published guidance and updates through the vendor advisory. Review the JVN Security Advisory and vendor bulletin to identify the specific firmware version that addresses CVE-2025-27722 for each affected model.
Workarounds
- Segregate access point management traffic on a dedicated VLAN unreachable from user networks
- Enforce encrypted tunnels (IPsec or SSH port forwarding) for any remote administration until the patch is applied
- Disable remote management interfaces and permit configuration only from a trusted, wired management host
- Deploy port security and dynamic ARP inspection on switches to reduce MITM opportunities
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
