CVE-2025-43928: Infodraw Pmrs-102 Path Traversal Flaw

CVE-2025-43928 Overview

CVE-2025-43928 is a path traversal vulnerability in Infodraw Media Relay Service (MRS) version 7.1.0.0. The MRS web server, listening on TCP port 12654, accepts ../ directory traversal sequences in the username field. Attackers can read arbitrary files from the underlying file system without authentication. Reading ServerParameters.xml exposes administrator credentials stored in cleartext or as MD5 hashes. The flaw maps to [CWE-22] (Path Traversal) and [CWE-24] (Path Traversal: '../filedir').

Critical Impact
Unauthenticated attackers can retrieve administrator credentials from ServerParameters.xml, leading to full compromise of the surveillance relay service and connected video infrastructure.

Affected Products

Infodraw PMRS-102
Infodraw PMRS-102 Firmware version 7.1.0.0
Infodraw Media Relay Service (MRS) 7.1.0.0

Discovery Timeline

2025-04-20 - CVE-2025-43928 published to NVD
2025-04-24 - Last updated in NVD database

Technical Details for CVE-2025-43928

Vulnerability Analysis

The Infodraw MRS web server processes HTTP authentication requests on port 12654 without sanitizing the username parameter. The application treats the username as a file path component during request handling. Submitting ../ sequences in the username field escapes the intended directory and traverses the file system.

The vulnerability requires no authentication, no user interaction, and no special privileges. Attackers reach the service over the network and issue a single crafted request to retrieve sensitive files. Targeting ServerParameters.xml returns administrator credentials, which are stored either in cleartext or as MD5 hashes susceptible to offline cracking.

The vulnerability is categorized as Path Traversal under [CWE-22] and [CWE-24]. Public technical analysis is available from Mint Secure Path Traversal Analysis and the Easterhegg Talk Presentation.

Root Cause

The MRS authentication handler concatenates user-supplied input into a file path without canonicalization or validation. The application does not enforce a base directory, reject .. sequences, or normalize the resulting path before opening the file.

Attack Vector

An attacker sends an HTTP request to port 12654 containing ../ traversal sequences in the username field. The server resolves the traversal, reads the targeted file, and returns its contents in the response. Retrieving ServerParameters.xml yields administrator credentials that enable full administrative takeover of the relay service.

The vulnerability manifests in the username field of the authentication endpoint. See the Mint Secure analysis for the technical breakdown of the request structure.

Detection Methods for CVE-2025-43928

Indicators of Compromise

HTTP requests to port 12654 containing ../, ..%2f, or encoded traversal sequences in the username field
Access log entries referencing ServerParameters.xml or other system configuration files
Outbound retrieval of credential files followed by successful administrator logins from new source addresses
Repeated authentication attempts from a single IP using varied path payloads

Detection Strategies

Inspect web server logs on port 12654 for traversal patterns and non-standard username values
Deploy IDS/IPS signatures that match ../ and URL-encoded variants in HTTP request bodies and parameters
Correlate file-read events on ServerParameters.xml with the originating network connection
Alert on administrator logins that follow recent anomalous traffic to the MRS service

Monitoring Recommendations

Enable verbose request logging on the MRS web server and forward logs to a central SIEM
Monitor file integrity on ServerParameters.xml and other configuration files within the MRS install directory
Restrict and audit network flows to TCP port 12654 from untrusted source ranges
Track failed and successful authentication attempts for sudden volume changes

How to Mitigate CVE-2025-43928

Immediate Actions Required

Block external access to TCP port 12654 at the perimeter firewall until a vendor patch is applied
Restrict MRS web server access to a management VLAN or VPN-only subnet
Rotate all administrator credentials configured in ServerParameters.xml, assuming prior exposure
Audit recent access logs for traversal patterns and unauthorized configuration reads

Patch Information

No vendor advisory or patch URL is listed in the public CVE record at the time of publication. Operators should contact Infodraw directly to confirm the availability of a fixed firmware release for PMRS-102 devices running version 7.1.0.0.

Workarounds

Place the MRS service behind a reverse proxy that strips ../ sequences and rejects path traversal payloads
Apply network ACLs limiting port 12654 to known administrative hosts
Replace MD5-hashed credentials with stronger secrets and enforce credential rotation
Disable the web management interface when not actively required for operations

bash

# Example iptables rule restricting MRS web server access to a management subnet
iptables -A INPUT -p tcp --dport 12654 -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 12654 -j DROP