CVE-2025-55075: WN-7D36QR SSH Auth Bypass Vulnerability

CVE-2025-55075 Overview

CVE-2025-55075 is a hidden functionality vulnerability affecting I-O Data WN-7D36QR and WN-7D36QR/UE wireless routers. A remote authenticated attacker can enable Secure Shell (SSH) on the device through undocumented functionality embedded in the firmware. Once SSH is enabled, the attacker gains an additional remote administrative channel that is not intended to be exposed under normal operation. The issue is categorized under CWE-912: Hidden Functionality. The vulnerability requires valid authentication but no user interaction, and it primarily impacts device integrity.

Critical Impact
Authenticated attackers can activate hidden SSH functionality on affected I-O Data routers, expanding the attack surface and enabling persistent remote administrative access.

Affected Products

I-O Data WN-7D36QR
I-O Data WN-7D36QR/UE
Firmware versions prior to the vendor-published fix (see I-O Data Support Information)

Discovery Timeline

2025-09-17 - CVE-2025-55075 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55075

Vulnerability Analysis

The WN-7D36QR and WN-7D36QR/UE firmware contains an undocumented capability that allows an authenticated user to enable the SSH service on the router. Because the functionality is hidden rather than exposed in the standard administrative interface, defenders and administrators cannot easily observe or govern its use. An attacker who has already obtained valid credentials, whether through phishing, credential reuse, or use of default credentials, can trigger this hidden path and turn on remote shell access.

Once SSH is active, the attacker has a persistent administrative channel into the router. This channel can be used to modify configuration, pivot into the internal network, intercept traffic, or maintain long-term presence beyond what the standard management UI would allow.

Root Cause

The root cause is the presence of hidden functionality in the shipped firmware [CWE-912]. The developer left an SSH-enabling code path reachable by authenticated requests without documenting it in the official interface or restricting it behind a controlled maintenance mode. This violates the principle of least functionality on embedded network devices.

Attack Vector

Exploitation requires network reachability to the router's management interface and valid authenticated credentials on the device. No user interaction is needed. After authenticating, the attacker invokes the hidden request that toggles the SSH daemon on, then connects to the newly opened SSH service to obtain shell-level access to the router.

No verified public proof-of-concept is available. Refer to the JVN Security Advisory JVNVU97490987 for coordinated disclosure details.

Detection Methods for CVE-2025-55075

Indicators of Compromise

Unexpected TCP/22 (SSH) listener exposed on WN-7D36QR or WN-7D36QR/UE routers where SSH was not previously enabled.
Successful SSH login events originating from the router or targeting the router's management IP.
Router configuration changes made outside of scheduled maintenance windows by administrative accounts.

Detection Strategies

Perform authenticated and unauthenticated network scans against router management IPs to identify open SSH ports on affected models.
Correlate authentication events on the router's management interface with subsequent changes in listening services.
Baseline known-good firmware behavior for the WN-7D36QR family and alert on deviations, particularly new open ports.

Monitoring Recommendations

Continuously monitor management VLAN traffic for connections to TCP/22 on devices that should not run SSH.
Ingest router syslog and administrative access logs into a centralized analytics platform for long-term retention and correlation.
Alert on repeated failed authentications against the router's web management interface, which often precede credential-based abuse of hidden functionality.

How to Mitigate CVE-2025-55075

Immediate Actions Required

Apply the firmware update published by I-O Data as described in the I-O Data Support Information.
Rotate administrative credentials on affected routers and disable any default or shared accounts.
Restrict the router's management interface to a dedicated management network or trusted source IPs only.
Audit affected devices for an active SSH listener and disable it if it was not intentionally enabled.

Patch Information

I-O Data has published a security advisory and updated firmware for the WN-7D36QR and WN-7D36QR/UE. Administrators should download and install the latest firmware directly from the vendor advisory. Coordinated disclosure details are available in the JVN advisory JVNVU97490987.

Workarounds

Block inbound TCP/22 to the router at the perimeter and on any upstream firewall until firmware is updated.
Enforce strong, unique administrator passwords and enable account lockout on repeated failed logins.
Segment the router's management plane from user and guest networks to reduce the pool of authenticated attackers.

bash

# Example: restrict SSH exposure at an upstream firewall (iptables)
iptables -A FORWARD -p tcp --dport 22 -d <router_ip> -j DROP
iptables -A INPUT   -p tcp --dport 22 -j DROP