CVE-2025-41379 Overview
CVE-2025-41379 affects the Intellian C700 web panel, which lets administrators add firewall rules through a JSON-based interface. The vulnerability stems from an inconsistency between the identifier stored in the database and the identifier returned in the JSON response when a rule is created. When an administrator later attempts to delete a rule, the system references the JSON ID rather than the database ID, and the deletion silently fails. An authenticated attacker with low privileges can abuse this behavior to create persistent firewall rules that cannot be removed through the normal interface. Recovery requires a factory reset of the device. The issue is categorized under [CWE-20] Improper Input Validation.
Critical Impact
Authenticated attackers can plant undeletable firewall rules on Intellian C700 satellite terminals, forcing a factory reset to restore normal firewall management.
Affected Products
- Intellian C700 web management panel
- Intellian Technologies Iridium Certus terminals (per INCIBE advisory)
- Firmware versions covered by the INCIBE multi-vulnerability notice
Discovery Timeline
- 2025-05-23 - CVE-2025-41379 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-41379
Vulnerability Analysis
The Intellian C700 web panel exposes a firewall management endpoint that accepts new rules as JSON documents. When a rule is created, the backend persists the entry with an internally generated database identifier. The response returned to the client, however, contains a different identifier field carried through the JSON payload. This mismatch is the core of CVE-2025-41379.
Deletion routines trust the JSON ID rather than resolving the actual database primary key. As a result, the delete operation targets an identifier that does not exist in the persistence layer. The rule remains active, silently, while the user interface indicates success or a benign failure. Because the entry cannot be addressed through supported management calls, the firewall policy drifts from the administrator's intended state.
An authenticated attacker with rule-creation privileges can weaponize the flaw by inserting rules that allow inbound traffic, block legitimate services, or maintain covert access paths. The rules survive reboots and cannot be scrubbed short of restoring factory defaults, which itself disrupts operations on a maritime or remote-site terminal.
Root Cause
The root cause is improper input validation and identifier reconciliation between the API layer and the database layer. The application accepts a client-controllable ID field in the JSON body and reuses it for downstream lookups without verifying that it matches the identifier assigned during insertion.
Attack Vector
Exploitation requires network access to the C700 web panel and valid low-privileged credentials. An attacker sends a crafted firewall-rule creation request whose JSON ID differs from what the backend will assign in storage. Subsequent delete requests, whether issued by the attacker or by a legitimate administrator, fail to remove the entry. No user interaction is required beyond the attacker's own authenticated session. No verified exploit code is publicly available at this time.
Refer to the INCIBE Notice on Multiple Vulnerabilities in Intellian Technologies Iridium Certus for vendor-coordinated advisory details.
Detection Methods for CVE-2025-41379
Indicators of Compromise
- Firewall rules present on the C700 that no administrator recognizes or can attribute to a change ticket.
- Repeated DELETE requests to the firewall-rule endpoint that return success but leave the rule active on inspection.
- Authenticated web-panel sessions from unexpected source IP addresses issuing rule-creation requests.
Detection Strategies
- Periodically export the running firewall configuration and diff it against the last approved baseline to surface unauthorized rules.
- Monitor web-panel access logs for POST requests to firewall-rule creation endpoints followed by failed deletions of the same logical rule.
- Correlate administrator account activity with change-management records to identify rule additions made outside sanctioned windows.
Monitoring Recommendations
- Forward C700 web-panel and system logs to a centralized log platform for retention and correlation.
- Alert on any creation of firewall rules by non-administrator accounts, and on rules created outside business hours.
- Track the count of active firewall rules over time and alert on unexplained growth.
How to Mitigate CVE-2025-41379
Immediate Actions Required
- Restrict network access to the C700 web management interface to a dedicated management VLAN or jump host.
- Rotate credentials for all accounts on the C700 and remove unused low-privileged accounts that can reach the firewall API.
- Audit the current firewall ruleset against a documented baseline and, if untrusted rules are present, plan a maintenance window for a factory reset.
Patch Information
No vendor patch identifier is included in the enriched CVE data. Administrators should consult the INCIBE Notice on Multiple Vulnerabilities in Intellian Technologies Iridium Certus for the current fixed firmware version and apply the vendor-supplied update once available.
Workarounds
- Place the C700 web panel behind a network filter that allows only known administrator source addresses.
- Enforce multi-factor authentication or strong unique passwords on all web-panel accounts to reduce the pool of accounts that can create rules.
- Perform a factory reset to clear undeletable rules, then reapply the approved firewall configuration from a version-controlled source of truth.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
