CVE-2025-57175: Siklu EtherHaul Auth Bypass Vulnerability

CVE-2025-57175 Overview

CVE-2025-57175 is a hardcoded credentials vulnerability affecting Siklu EtherHaul 8010 wireless backhaul devices. The affected devices running firmware version siklu-uimage-nxp-enc-10_6_2-18707-ea552dc00b contain a static root password embedded in the firmware, allowing an attacker with physical access to gain full administrative control over the device.

Critical Impact

An attacker with physical access to the device can authenticate as root using the hardcoded credentials, potentially compromising network infrastructure and enabling lateral movement within connected networks.

Affected Products

• Siklu EtherHaul 8010 devices
• Firmware version siklu-uimage-nxp-enc-10_6_2-18707-ea552dc00b

Discovery Timeline

• 2026-04-08 - CVE CVE-2025-57175 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2025-57175

Vulnerability Analysis

This vulnerability falls under CWE-259 (Use of Hard-coded Password), a critical security weakness commonly found in embedded systems and IoT devices. The Siklu EtherHaul 8010, a point-to-point wireless backhaul device used in telecommunications and enterprise networks, contains firmware with a static root password that cannot be changed by end users.

While the attack requires physical access to the device (reducing the overall risk profile), successful exploitation grants complete root-level access to the underlying Linux-based operating system. This level of access enables an attacker to modify device configurations, intercept network traffic, install persistent backdoors, or use the compromised device as a pivot point for further network attacks.

The physical access requirement provides some mitigation, as these devices are typically deployed in secured locations such as rooftops, telecommunications facilities, or data centers. However, organizations with inadequate physical security controls or those deploying these devices in publicly accessible areas face elevated risk.

Root Cause

The root cause of this vulnerability is the inclusion of a hardcoded root password in the device firmware. This is a common shortcoming in embedded device development where manufacturers embed static credentials for debugging, manufacturing, or support purposes but fail to remove or randomize them before shipping to customers.

The firmware encryption used by Siklu devices can be bypassed to extract the embedded credentials, as documented in publicly available firmware decryption research. Once the firmware is decrypted, attackers can extract the static password hash and either crack it or use it directly for authentication.

Attack Vector

The attack vector for CVE-2025-57175 requires physical access to the device. An attacker would need to:

1. Gain physical access to the Siklu EtherHaul 8010 device
2. Connect to the device via console port, serial interface, or local network connection
3. Authenticate using the static root password embedded in the firmware
4. Achieve full root-level access to the device operating system

The physical access requirement increases attack complexity but does not eliminate the threat, particularly for devices deployed in locations with insufficient physical security controls or in scenarios where malicious insiders have access to network equipment.

Detection Methods for CVE-2025-57175

Indicators of Compromise

• Unexpected root-level login attempts on Siklu EtherHaul 8010 devices
• Configuration changes made outside of normal maintenance windows
• Unusual network traffic patterns originating from the wireless backhaul device
• Evidence of firmware extraction or analysis tools used against the device

Detection Strategies

• Monitor authentication logs on Siklu EtherHaul devices for root login events
• Implement network segmentation to isolate management interfaces from untrusted networks
• Deploy intrusion detection systems to monitor for anomalous traffic from backhaul devices
• Conduct regular configuration audits to detect unauthorized modifications

Monitoring Recommendations

• Enable and centralize logging for all Siklu EtherHaul device authentication events
• Monitor physical access controls at device deployment locations
• Implement network behavior analysis to detect traffic anomalies from wireless backhaul infrastructure
• Establish baseline configurations and alert on deviations

How to Mitigate CVE-2025-57175

Immediate Actions Required

• Audit physical security controls at all locations where Siklu EtherHaul 8010 devices are deployed
• Restrict network access to device management interfaces using firewall rules or VLANs
• Contact Siklu support to inquire about firmware updates that address this vulnerability
• Monitor device authentication logs for any suspicious login activity

Patch Information

No vendor patch information is currently available in the CVE data. Organizations should contact Siklu directly to inquire about firmware updates that address the static root password vulnerability. Monitor Siklu's official security advisories for updates regarding this issue.

For additional technical context on this vulnerability and related firmware analysis, refer to the SemaJa2 Firmware Decryption Guide.

Workarounds

• Implement strict physical access controls at all device deployment locations
• Segment management network interfaces away from general network traffic
• Deploy network access control (NAC) solutions to restrict connections to management interfaces
• Consider implementing out-of-band management networks for critical infrastructure devices
• Disable unused console and management ports where possible