CVE-2025-63225

The Eurolab ELTS100_UBX device (firmware version ELTS100v1.UBX) is vulnerable to Broken Access Control due to missing authentication on critical administrative endpoints. Attackers can directly access and modify sensitive system and network configurations, upload firmware, and execute unauthorized actions without any form of authentication. This vulnerability allows remote attackers to fully compromise the device, control its functionality, and disrupt its operation.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://eurolab-srl.com/	Product
https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63225_Eurolab_ELTS100_UBX_Broken_Access_Control	Exploit Mitigation Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:eurolab-srl:elts_100_firmware:elts100v1.ubx:*:*:*:*:*:*:*

cpe:2.3:h:eurolab-srl:elts_100:e118:*:*:*:*:*:*:*

History

05 Nov 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) El dispositivo Eurolab ELTS100_UBX (versión de firmware ELTS100v1.UBX) es vulnerable a Control de Acceso Roto debido a la falta de autenticación en endpoints administrativos críticos. Los atacantes pueden acceder y modificar directamente configuraciones sensibles del sistema y de la red, subir firmware, y ejecutar acciones no autorizadas sin ninguna forma de autenticación. Esta vulnerabilidad permite a atacantes remotos comprometer completamente el dispositivo, controlar su funcionalidad y perturbar su operación.

Information

Published : 2025-11-18 19:15

Updated : 2026-11-05 14:10

NVD link : CVE-2025-63225

Mitre link : CVE-2025-63225

CVE.ORG link : CVE-2025-63225

JSON object : View

Products Affected

eurolab-srl

elts_100_firmware
elts_100

CWE

CWE-284

Improper Access Control

{"id": "CVE-2025-63225", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-63225", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-19T18:49:43.240129Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-11-18T19:15:50.823", "references": [{"url": "http://eurolab-srl.com/", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63225_Eurolab_ELTS100_UBX_Broken_Access_Control", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "The Eurolab ELTS100_UBX device (firmware version ELTS100v1.UBX) is vulnerable to Broken Access Control due to missing authentication on critical administrative endpoints. Attackers can directly access and modify sensitive system and network configurations, upload firmware, and execute unauthorized actions without any form of authentication. This vulnerability allows remote attackers to fully compromise the device, control its functionality, and disrupt its operation."}, {"lang": "es", "value": "El dispositivo Eurolab ELTS100_UBX (versi\u00f3n de firmware ELTS100v1.UBX) es vulnerable a Control de Acceso Roto debido a la falta de autenticaci\u00f3n en endpoints administrativos cr\u00edticos. Los atacantes pueden acceder y modificar directamente configuraciones sensibles del sistema y de la red, subir firmware, y ejecutar acciones no autorizadas sin ninguna forma de autenticaci\u00f3n. Esta vulnerabilidad permite a atacantes remotos comprometer completamente el dispositivo, controlar su funcionalidad y perturbar su operaci\u00f3n."}], "lastModified": "2026-11-05T14:10:00.273", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:eurolab-srl:elts_100_firmware:elts100v1.ubx:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "13EA443D-4342-441B-90E8-E3A4E8AD64FE"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:eurolab-srl:elts_100:e118:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7AA93461-B45F-4A8B-B670-0B1576586E54"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}