CVE-2025-65212: NJHYST HY511 POE Auth Bypass Vulnerability

CVE-2025-65212 Overview

CVE-2025-65212 is an authentication bypass vulnerability discovered in NJHYST HY511 POE core devices. The vulnerability stems from insufficient cookie verification in the device's web management interface, allowing unauthenticated attackers to directly access and download the core configuration file without proper authentication. By extracting username credentials and self-decrypted MD5 passwords from this configuration file, attackers can bypass the login page entirely and gain unauthorized administrative access to the device backend.

Critical Impact

This vulnerability allows unauthenticated remote attackers to completely bypass authentication controls, download sensitive configuration files containing credentials, and gain full administrative access to affected NJHYST HY511 POE devices.

Affected Products

• NJHYST HY511 POE core versions before 2.1
• NJHYST HY511 POE plugins versions before 0.1
• NJHYST HY511 POE device management backend

Discovery Timeline

• 2026-01-06 - CVE-2025-65212 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-65212

Vulnerability Analysis

This vulnerability is classified under CWE-565 (Reliance on Cookies without Validation or Integrity Checking). The NJHYST HY511 POE device fails to properly validate session cookies when processing requests to access the configuration file endpoint. This design flaw allows attackers to craft direct HTTP requests to the configuration file address without establishing a valid authenticated session.

The attack chain exploits two critical weaknesses: first, the lack of proper authentication verification for sensitive file access endpoints, and second, the storage of credentials in a recoverable format within the configuration file. The MD5-hashed passwords stored in the configuration can be decrypted using the device's own decryption mechanism, providing attackers with plaintext credentials.

Root Cause

The root cause of this vulnerability lies in the device's improper implementation of access controls for sensitive configuration endpoints. The web management interface relies solely on cookie-based authentication without proper server-side validation. When an attacker directly requests the configuration file URL, the system fails to verify whether the request originates from an authenticated session, allowing unauthorized access to sensitive system files containing administrative credentials.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker with network access to the device's management interface can exploit this vulnerability by:

1. Identifying the configuration file endpoint through reconnaissance or documentation review
2. Sending a direct HTTP request to the configuration file address without authentication cookies
3. Downloading the core configuration file containing usernames and MD5-hashed passwords
4. Decrypting the MD5 passwords using the device's self-decryption capability
5. Using the recovered credentials to authenticate to the device backend with full administrative privileges

The vulnerability is particularly severe because it can be exploited remotely over the network without any prerequisites, allowing complete compromise of affected devices.

Detection Methods for CVE-2025-65212

Indicators of Compromise

• Unauthorized HTTP requests to configuration file endpoints without valid session tokens
• Unusual download activity targeting device configuration files from external IP addresses
• Multiple failed or successful login attempts using credentials extracted from configuration files
• Access logs showing direct requests to sensitive file paths bypassing the login workflow
• Anomalous administrative sessions originating from unexpected network locations

Detection Strategies

• Monitor web server access logs for direct requests to configuration file paths without preceding authentication requests
• Implement network intrusion detection rules to identify attempts to access known configuration file URLs
• Alert on successful administrative logins from IP addresses that did not complete the standard authentication flow
• Deploy file integrity monitoring on configuration files to detect unauthorized access or exfiltration

Monitoring Recommendations

• Enable verbose logging on the device management interface to capture all access attempts to sensitive endpoints
• Configure SIEM rules to correlate configuration file access events with authentication events
• Implement network segmentation to restrict management interface access to authorized administrator networks only
• Establish baseline access patterns for the management interface and alert on deviations

How to Mitigate CVE-2025-65212

Immediate Actions Required

• Update NJHYST HY511 POE core to version 2.1 or later immediately
• Update NJHYST HY511 POE plugins to version 0.1 or later
• Restrict network access to the device management interface using firewall rules or network segmentation
• Change all administrative credentials on affected devices after patching
• Review access logs for any signs of prior exploitation

Patch Information

The vendor has addressed this vulnerability in NJHYST HY511 POE core version 2.1 and plugins version 0.1. Organizations should upgrade to these versions or later to remediate the vulnerability. Additional technical details are available in the GitHub security documentation and GitHub Gist resource.

Workarounds

• Implement network-level access controls to restrict management interface access to trusted IP addresses only
• Deploy a web application firewall (WAF) to block direct requests to configuration file endpoints
• Place the device management interface behind a VPN to prevent direct internet exposure
• Disable remote management access if not required and manage devices locally only

# Example network access restriction using iptables
# Restrict management interface access to trusted admin network only
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP