CVE-2025-62775 Overview
CVE-2025-62775 affects Mercku M6a wireless router devices through firmware version 2.1.0. The device exposes a TELNET service that accepts root logins authenticated with the web administrator password. An attacker on the adjacent network who obtains or guesses the web admin credentials gains an unrestricted root shell on the router. The vulnerability is categorized under [CWE-669: Incorrect Resource Transfer Between Spheres], reflecting the improper reuse of a web-interface credential for a privileged operating system service.
Critical Impact
Adjacent-network attackers with the web admin password can obtain a root TELNET shell on affected Mercku M6a routers, gaining full control of network traffic and device configuration.
Affected Products
- Mercku M6a router firmware versions up to and including 2.1.0
Discovery Timeline
- 2025-10-22 - CVE-2025-62775 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-62775
Vulnerability Analysis
The Mercku M6a router exposes a TELNET daemon that authenticates the root account using the same password configured for the web administration interface. This design collapses two distinct authentication spheres, an unencrypted remote shell service and a web management console, into a shared credential. An attacker who recovers the web password through phishing, default-credential reuse, brute force, or interception on the local network can pivot directly to a root shell. TELNET transmits credentials and session data in cleartext, which further widens the exposure on the adjacent network segment.
Once authenticated, the attacker gains full command execution as root. This enables firmware modification, persistent backdoors, DNS hijacking, traffic interception, and lateral movement to any device behind the router. Public exploit analysis is available in the Nullvoid Blog Exploit Analysis and the Full Disclosure Mailing List Post.
Root Cause
The root cause is an insecure design decision to bind the TELNET root account to the web admin credential store rather than requiring a separate, service-specific authentication mechanism or disabling remote shell access by default. This falls under [CWE-669], where a resource, in this case an authentication credential, is transferred between security domains that should remain isolated.
Attack Vector
Exploitation requires adjacent network access, typically meaning the attacker is on the same Wi-Fi network or wired LAN segment as the router. The attacker connects to the TELNET port on the router, supplies root as the username, and provides the known or recovered web admin password. No user interaction is required, and no additional privilege escalation is needed after login.
No verified proof-of-concept code is published in the NVD reference set. See the referenced exploit analysis for technical details on reproduction.
Detection Methods for CVE-2025-62775
Indicators of Compromise
- Unexpected TCP connections to port 23 (TELNET) on the Mercku M6a management interface from LAN clients.
- New or unrecognized processes spawned by the TELNET daemon on the router, indicating post-authentication shell activity.
- Modifications to router configuration files, DNS settings, or firewall rules that were not initiated by an administrator.
Detection Strategies
- Monitor LAN traffic for TELNET sessions originating from or terminating at the router IP address.
- Alert on successful TELNET authentication events in router syslog exports where such access is not part of an approved administrative workflow.
- Correlate router configuration changes with authenticated administrative sessions to identify out-of-band modifications.
Monitoring Recommendations
- Forward router syslog to a centralized logging platform and retain authentication and shell-session records.
- Baseline expected management-plane traffic to the router and alert on any deviation, particularly cleartext protocol usage.
- Perform periodic network scans of the internal subnet to identify devices exposing TELNET on port 23.
How to Mitigate CVE-2025-62775
Immediate Actions Required
- Disable TELNET on the Mercku M6a router if the device configuration permits it.
- Change the web administrator password to a long, unique value not shared with any other system.
- Restrict management-interface access to a dedicated management VLAN and block port 23 at any upstream firewall.
- Segment untrusted wireless clients from the router management interface using guest network isolation.
Patch Information
No vendor patch is listed in the NVD entry at the time of publication. Consult the vendor for firmware updates beyond version 2.1.0, and review the Full Disclosure Mailing List Post for the latest remediation status.
Workarounds
- Place the affected router behind a network segment that blocks inbound TELNET traffic from client subnets.
- Replace the affected device with hardware that does not expose cleartext remote shell services bound to web credentials.
- Rotate the web admin credential regularly and audit for reuse across other managed assets.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
