CVE-2025-44018: GL-Inet GL-AXT1800 Firmware Downgrade Flaw

CVE-2025-44018 Overview

A firmware downgrade vulnerability exists in the OTA (Over-the-Air) Update functionality of GL-Inet GL-AXT1800 router running firmware version 4.7.0. This vulnerability allows an attacker to force the device to install an older, potentially vulnerable firmware version by intercepting the update process. The attack requires a man-in-the-middle (MITM) position and involves crafting a specially designed .tar file that the router accepts as a legitimate firmware update.

Critical Impact

Attackers can downgrade router firmware to versions containing known vulnerabilities, enabling further exploitation of patched security flaws and potentially gaining complete control over the network device.

Affected Products

• GL-Inet GL-AXT1800 firmware version 4.7.0

Discovery Timeline

• 2025-11-24 - CVE CVE-2025-44018 published to NVD
• 2025-11-25 - Last updated in NVD database

Technical Details for CVE-2025-44018

Vulnerability Analysis

This vulnerability is classified under CWE-295 (Improper Certificate Validation), indicating that the OTA update mechanism fails to properly validate the authenticity and integrity of firmware packages during the update process. The GL-AXT1800 router does not adequately verify that firmware updates come from a trusted source or that they represent a newer version than the currently installed firmware.

The vulnerability enables attackers positioned between the router and update servers to intercept firmware update requests and inject malicious responses containing older firmware versions. This attack vector is particularly dangerous because firmware downgrades can reintroduce previously patched security vulnerabilities, effectively undoing months or years of security improvements.

Root Cause

The root cause stems from improper certificate validation in the OTA update process. The router's update mechanism does not sufficiently verify the SSL/TLS certificates presented during firmware downloads, allowing attackers to present fraudulent certificates and serve malicious content. Additionally, the firmware lacks proper version comparison checks that would prevent downgrades to older firmware versions. This combination of missing certificate validation and absent version enforcement creates a path for firmware downgrade attacks.

Attack Vector

The attack requires network-level access to perform a man-in-the-middle attack between the GL-AXT1800 router and the GL-Inet update servers. An attacker must:

1. Position themselves on the network path between the router and update infrastructure
2. Intercept the router's request for firmware updates
3. Craft a malicious .tar file containing an older firmware version
4. Present the malicious firmware package to the router as a legitimate update
5. The router, due to insufficient validation, accepts and installs the downgraded firmware

This attack is particularly feasible in environments where the attacker controls network infrastructure, such as compromised ISPs, malicious Wi-Fi access points, or through ARP spoofing on local networks. For additional technical details, refer to the Talos Intelligence Vulnerability Report.

Detection Methods for CVE-2025-44018

Indicators of Compromise

• Unexpected firmware version changes on GL-AXT1800 devices, particularly downgrades to older versions
• Suspicious network traffic patterns during firmware update processes
• TLS/SSL certificate warnings or anomalies during device communications with update servers
• Unexplained device reboots that coincide with network update activity

Detection Strategies

• Monitor firmware version logs on GL-AXT1800 devices for unexpected downgrades
• Implement network monitoring to detect potential MITM attacks targeting router update traffic
• Deploy SSL inspection to identify certificate substitution attempts on the network
• Maintain an inventory of expected firmware versions and alert on deviations

Monitoring Recommendations

• Configure network intrusion detection systems to monitor traffic to and from GL-Inet update servers
• Implement regular firmware version audits across all GL-AXT1800 devices in the network
• Monitor DNS queries for update-related domains that could indicate update interception attempts
• Log and review all firmware update events on network devices

How to Mitigate CVE-2025-44018

Immediate Actions Required

• Disable automatic OTA updates on GL-AXT1800 routers until a patched firmware version is available
• Manually download and verify firmware updates directly from the official GL-Inet website using a trusted network connection
• Implement network segmentation to isolate management traffic for network devices
• Deploy TLS inspection and certificate pinning where possible to detect MITM attempts

Patch Information

Check the official GL-Inet support channels and the Talos Intelligence Vulnerability Report for updated firmware releases that address this vulnerability. Firmware versions beyond 4.7.0 should be verified to contain fixes for the improper certificate validation issue before deployment.

Workarounds

• Perform firmware updates only through a secure, trusted network connection with verified TLS certificates
• Use VPN connections when performing firmware updates on remote devices
• Implement network access controls to prevent unauthorized devices from intercepting update traffic
• Consider manual firmware updates via USB or local file upload instead of OTA updates
• Monitor network traffic for signs of MITM attacks, particularly during update operations

To manually update firmware and bypass OTA, access the router's administrative interface at the local IP address and navigate to the firmware upload section. Download the firmware directly from the GL-Inet official website over a trusted connection, verify the file integrity using provided checksums, and upload the firmware file locally to the device.