CVE-2025-36535: Embedded Web Server Auth Bypass Flaw

CVE-2025-36535 Overview

CVE-2025-36535 is a missing authentication vulnerability [CWE-306] affecting the embedded web server of an industrial control system (ICS) device. The web server exposes management functionality over the network without enforcing authentication or access controls. Any attacker with network reachability to the device can interact with administrative interfaces directly.

The flaw is documented in CISA ICS Advisory ICSA-25-140-09 and affects the AutomationDirect EKI-1221-CE Modbus gateway product line. Exploitation can result in configuration tampering, operational disruption, or arbitrary code execution depending on exposed functionality.

Critical Impact
Unauthenticated remote attackers can modify device configuration, disrupt industrial operations, or execute arbitrary code on the gateway with no user interaction required.

Affected Products

AutomationDirect EKI-1221-CE Modbus Gateway
Related AutomationDirect protocol gateway models referenced in CISA ICS Advisory ICSA-25-140-09
Industrial deployments exposing the embedded web management interface to reachable networks

Discovery Timeline

2025-05-21 - CVE-2025-36535 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-36535

Vulnerability Analysis

The vulnerability resides in the embedded web server shipped with the affected protocol gateway firmware. The web interface provides administrative functions including device configuration, network parameter changes, and operational control. The server does not require credentials or enforce access controls before processing requests.

An attacker who can reach the device on TCP can interact with these endpoints directly. Industrial gateways frequently bridge operational technology (OT) and information technology (IT) networks, making this exposure attractive to attackers pivoting from IT environments into control system networks.

The scope rating in the CVSS v4.0 vector indicates that successful exploitation can impact systems beyond the device itself, including downstream Modbus-connected industrial equipment.

Root Cause

The underlying weakness is [CWE-306: Missing Authentication for Critical Function]. The firmware exposes critical management endpoints without an authentication layer. There is no session validation, no credential check, and no role-based access control applied to sensitive operations. Any HTTP request reaching the web server is processed as if it originated from an authorized administrator.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends crafted HTTP requests to the gateway's management interface over TCP. Operations available without authentication include reading and writing configuration, modifying network settings, altering Modbus routing rules, and in some cases triggering firmware-level functions that enable arbitrary code execution.

In typical industrial deployments, the gateway is reachable from engineering workstations, historians, and supervisory control and data acquisition (SCADA) servers. An attacker who compromises any of these adjacent systems gains immediate administrative control of the gateway. Refer to CISA ICS Advisory ICSA-25-140-09 for vendor-specific technical details.

Detection Methods for CVE-2025-36535

Indicators of Compromise

Unexpected HTTP requests to the gateway management interface from non-administrative source addresses
Unauthorized changes to device configuration, firmware versions, or Modbus routing tables
New or modified user accounts and altered network parameters on the gateway
Anomalous Modbus traffic patterns originating from the affected gateway to downstream programmable logic controllers (PLCs)

Detection Strategies

Monitor and log all HTTP and HTTPS traffic destined to the gateway management port and alert on access from sources outside an approved administrative allowlist
Baseline the gateway configuration and continuously compare running configuration against the baseline to detect unauthorized modifications
Deploy network intrusion detection signatures for unauthenticated administrative API calls to ICS protocol gateways

Monitoring Recommendations

Capture network flows between IT and OT segments and alert on any new source communicating with the gateway web interface
Forward gateway logs and configuration change events to a centralized SIEM for correlation with endpoint telemetry from adjacent engineering workstations
Track Modbus command patterns for write operations that fall outside normal operational profiles

How to Mitigate CVE-2025-36535

Immediate Actions Required

Remove the affected gateway from any internet-reachable network segment and verify it is not exposed through misconfigured firewalls or VPN routes
Restrict management interface access to a dedicated administrative VLAN reachable only from authorized engineering workstations
Inventory all AutomationDirect protocol gateways in the environment and confirm firmware versions against the affected list in ICSA-25-140-09
Review recent configuration history on each device to identify unauthorized changes

Patch Information

Consult the vendor advisory referenced in CISA ICS Advisory ICSA-25-140-09 for available firmware updates and remediation guidance. Apply firmware updates through validated change control procedures appropriate for the operational environment.

Workarounds

Place the gateway behind a firewall that permits inbound connections to the management interface only from a small set of administrative source IP addresses
Disable the embedded web server entirely if device management can be performed through an alternative authenticated channel
Segment OT networks per ISA/IEC 62443 zone and conduit guidance to limit lateral movement to the gateway from compromised IT hosts
Deploy a reverse proxy or jump host enforcing authentication in front of the management interface where direct firmware remediation is not yet feasible

bash

# Example: restrict management interface access with iptables on an upstream gateway
# Allow only the administrative workstation subnet to reach the device web UI
iptables -A FORWARD -s 10.10.50.0/24 -d 192.0.2.10 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -s 10.10.50.0/24 -d 192.0.2.10 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 192.0.2.10 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 192.0.2.10 -p tcp --dport 443 -j DROP