CVE-2025-67113: Sercomm SCE4255W CWMP Client RCE Flaw

CVE-2025-67113 Overview

A critical OS command injection vulnerability exists in the CWMP client (/ftl/bin/cwmp) of the Sercomm SCE4255W Small Cell, also known as the FreedomFi Englewood device. This firmware vulnerability, present in versions before DG3934v3@2308041842, allows remote attackers who control the Auto Configuration Server (ACS) endpoint to execute arbitrary commands with root privileges. The attack is facilitated through a crafted TR-069 Download URL that is passed unescaped into the firmware upgrade pipeline, enabling full system compromise.

Critical Impact

Remote attackers controlling the ACS endpoint can achieve root-level command execution on affected Small Cell devices, potentially compromising cellular network infrastructure and enabling persistent unauthorized access.

Affected Products

• Sercomm SCE4255W (FreedomFi Englewood) firmware versions before DG3934v3@2308041842
• Small Cell devices utilizing the vulnerable CWMP client implementation
• TR-069 enabled network equipment with unpatched firmware

Discovery Timeline

• 2026-03-19 - CVE-2025-67113 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2025-67113

Vulnerability Analysis

This command injection vulnerability targets the CPE WAN Management Protocol (CWMP) client, a TR-069 implementation responsible for remote device management and firmware updates. The flaw resides in how the CWMP client processes Download URLs received from the ACS during firmware upgrade operations.

When the device receives a TR-069 Download request, the URL parameter is incorporated into the firmware upgrade pipeline without proper sanitization or escaping. This architectural weakness allows an attacker with control over the ACS endpoint to inject shell metacharacters and arbitrary commands into the download URL, which are then executed by the system with root privileges.

The vulnerability is particularly severe in telecommunications infrastructure contexts, as Small Cell devices like the SCE4255W serve as critical components in cellular network deployments. Successful exploitation grants attackers complete control over the device, potentially enabling network traffic interception, persistent backdoor installation, or pivot attacks against connected infrastructure.

Root Cause

The root cause of this vulnerability is the failure to sanitize or properly escape user-controlled input before passing it to shell execution contexts. Specifically, the CWMP client at /ftl/bin/cwmp directly incorporates the TR-069 Download URL parameter into command-line operations within the firmware upgrade pipeline without validating or sanitizing the input for shell metacharacters. This represents a classic command injection pattern where untrusted data flows directly into a privileged execution context.

Attack Vector

The attack vector requires the adversary to control or compromise the ACS endpoint that the vulnerable device communicates with for TR-069 management operations. This could be achieved through:

1. Compromising the legitimate ACS server used by the target device
2. Man-in-the-middle attacks to intercept and modify TR-069 communications
3. DNS hijacking to redirect the device's ACS communications to an attacker-controlled server
4. Rogue ACS deployment in environments where device ACS configuration can be manipulated

Once positioned as the ACS, the attacker initiates a TR-069 Download operation with a malicious URL containing embedded shell commands. These commands are passed unescaped through the firmware upgrade process and executed with root privileges on the target device.

The exploitation mechanism involves crafting a Download URL that includes shell metacharacters (such as semicolons, backticks, or command substitution syntax) followed by malicious commands. When the CWMP client processes this URL, the injected commands are executed in the context of the firmware upgrade operation. For detailed technical analysis, refer to the Nero Team Blog on FreedomFi.

Detection Methods for CVE-2025-67113

Indicators of Compromise

• Unusual outbound network connections from Small Cell devices to unknown external hosts
• Unexpected processes running with root privileges on the device
• Modified system files or the presence of unauthorized scripts in firmware directories
• Anomalous TR-069 Download requests containing shell metacharacters or unusual URL patterns
• Evidence of command execution artifacts in system logs related to the CWMP client

Detection Strategies

• Monitor TR-069 communications for Download URLs containing shell metacharacters such as ;, |, $(), or backticks
• Implement network-level inspection of CWMP traffic between devices and ACS endpoints
• Deploy integrity monitoring on Small Cell device firmware and configuration files
• Establish baseline behavior profiles for CWMP client processes and alert on deviations
• Review ACS server logs for suspicious Download request patterns

Monitoring Recommendations

• Enable comprehensive logging on ACS servers and correlate with device-side events
• Implement TLS certificate validation for all TR-069 communications to prevent MITM attacks
• Deploy network segmentation to isolate Small Cell management traffic from general network access
• Utilize SentinelOne Singularity platform for endpoint visibility and behavioral analysis on network infrastructure where applicable

How to Mitigate CVE-2025-67113

Immediate Actions Required

• Upgrade affected Sercomm SCE4255W devices to firmware version DG3934v3@2308041842 or later immediately
• Audit and verify the integrity of ACS server configurations and access controls
• Implement strict network access controls limiting which endpoints can communicate with device management interfaces
• Review device logs for evidence of prior exploitation attempts
• Consider temporarily disabling TR-069 functionality if firmware updates cannot be immediately applied

Patch Information

The vulnerability is resolved in firmware version DG3934v3@2308041842 and later releases. Organizations should coordinate with Sercomm or FreedomFi for firmware acquisition and deployment guidance. Additional technical details and device specifications can be found in the FCC Device Report. For product information, visit the FreedomFi Homepage.

Workarounds

• Restrict network access to the TR-069 management interface using firewall rules or network segmentation
• Implement mutual TLS authentication between devices and ACS endpoints where supported
• Deploy network-level monitoring to detect and block suspicious TR-069 traffic patterns
• If TR-069 functionality is not required, disable the CWMP client on affected devices
• Implement egress filtering to prevent compromised devices from establishing connections to attacker infrastructure

# Example network segmentation configuration (iptables)
# Restrict TR-069 traffic to authorized ACS server only
iptables -A OUTPUT -p tcp --dport 7547 -d <authorized_acs_ip> -j ACCEPT
iptables -A OUTPUT -p tcp --dport 7547 -j DROP
iptables -A INPUT -p tcp --sport 7547 -s <authorized_acs_ip> -j ACCEPT
iptables -A INPUT -p tcp --sport 7547 -j DROP