CVE-2025-6225: Kieback&Peter SM70 PHWEB RCE Vulnerability

CVE-2025-6225 Overview

CVE-2025-6225 is a command injection vulnerability affecting the Kieback&Peter Neutrino-GLT building management system. The web component "SM70 PHWEB" is vulnerable to shell command injection via the login form. An unauthenticated attacker can exploit this vulnerability over the network to execute arbitrary shell commands on the underlying system, though the injected commands execute with low privileges.

Critical Impact

Unauthenticated attackers can execute arbitrary shell commands on building management systems via the login form, potentially compromising critical infrastructure environments.

Affected Products

• Kieback&Peter Neutrino-GLT with SM70 PHWEB component (versions prior to 9.40.02)
• Building management systems utilizing the affected web interface

Discovery Timeline

• 2026-01-07 - CVE-2025-6225 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-6225

Vulnerability Analysis

This vulnerability is classified as OS Command Injection (CWE-78), a severe class of security flaws where user-supplied input is passed unsanitized to a system shell. In the case of CVE-2025-6225, the SM70 PHWEB component fails to properly validate and sanitize user input in the login form before incorporating it into shell commands executed on the underlying operating system.

Building management systems like Neutrino-GLT are deployed in critical infrastructure environments including commercial buildings, industrial facilities, and data centers. These systems control HVAC, lighting, access control, and other building automation functions. Successful exploitation could allow attackers to manipulate building systems, pivot to other network resources, or establish persistent access.

The network-based attack vector with no authentication requirements makes this vulnerability particularly concerning for internet-exposed instances. While the injected commands execute with low privileges, attackers may combine this with privilege escalation techniques to achieve full system compromise.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and sanitization within the SM70 PHWEB login form processing logic. User-supplied input from login form fields is passed directly to shell command execution without proper escaping or validation, allowing shell metacharacters and command separators to be interpreted by the underlying operating system.

Attack Vector

The attack is executed remotely over the network without requiring authentication. An attacker can craft malicious input containing shell metacharacters (such as ;, |, &, or backticks) within the login form fields. When the application processes this input, the injected commands are executed by the shell. While the commands run with limited privileges, this still provides attackers with a foothold on the target system.

The attack flow typically involves:

1. Identifying an exposed Neutrino-GLT SM70 PHWEB interface
2. Crafting login requests with shell command injection payloads
3. Observing command execution through timing delays, DNS callbacks, or direct output

Since no verified code examples are available, readers should consult the CERT Polska advisory for technical details on the specific injection vectors and payload formats.

Detection Methods for CVE-2025-6225

Indicators of Compromise

• Unusual characters in web server access logs for login endpoints (shell metacharacters like ;, |, &, `, $())
• Unexpected outbound network connections from building management systems
• New user accounts or modified system configurations on Neutrino-GLT devices
• Process execution anomalies originating from the web server process

Detection Strategies

• Deploy web application firewalls (WAF) with rules to detect command injection patterns in HTTP POST requests to login endpoints
• Monitor web server logs for suspicious login attempts containing shell metacharacters or encoded command sequences
• Implement network detection rules for common command injection callback patterns (DNS exfiltration, reverse shells)
• Use intrusion detection systems with signatures for command injection exploitation attempts

Monitoring Recommendations

• Enable verbose logging on Neutrino-GLT web interfaces and forward logs to a centralized SIEM
• Monitor for unexpected process spawning from the web application context
• Track outbound connections from building management network segments to detect potential command-and-control activity
• Implement baseline monitoring for normal system behavior to detect anomalies indicative of compromise

How to Mitigate CVE-2025-6225

Immediate Actions Required

• Update Kieback&Peter Neutrino-GLT SM70 PHWEB component to version 9.40.02 or later immediately
• Restrict network access to building management interfaces using firewall rules and network segmentation
• Review logs for signs of prior exploitation attempts or successful compromise
• Ensure building management systems are not directly exposed to the internet

Patch Information

Kieback&Peter has addressed this vulnerability in version 9.40.02 of the Neutrino-GLT SM70 PHWEB component. Organizations should prioritize patching, particularly for any internet-facing deployments. Refer to the CERT Polska advisory for additional details on the remediation.

Workarounds

• Implement network segmentation to isolate building management systems from general network traffic and the internet
• Deploy a web application firewall with command injection detection rules in front of the SM70 PHWEB interface
• Restrict access to the web management interface to trusted IP addresses only using firewall ACLs
• Consider disabling the web interface entirely if not operationally required until patching can be completed

# Example firewall rule to restrict access to management interface (adjust for your environment)
# Restrict access to BMS web interface to management VLAN only
iptables -A INPUT -p tcp --dport 443 -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP