Overview
A significant security vulnerability, identified as CVE-2025-63209, has been discovered in the ELCA Star Transmitter Remote Control firmware version 1.25. This flaw allows unauthenticated attackers to retrieve sensitive information, including admin credentials and system settings, due to an unprotected endpoint. This poses a serious security risk to systems using affected ELCA Star Transmitter models.
Technical Details
The vulnerability lies within the /setup.xml endpoint of the ELCA Star Transmitter Remote Control firmware 1.25. This endpoint is not protected by any authentication mechanism, allowing anyone with network access to the device to retrieve its contents. Critically, the admin password is stored in plaintext within the <p05> XML tag. The affected models include STAR150, BP1000, STAR300, STAR2000, STAR1000, STAR500, and potentially other models using the same firmware version.
The unencrypted storage of sensitive credentials in a publicly accessible file is a severe security lapse that can lead to complete system compromise.
CVSS Analysis
Currently, a CVSS score has not been assigned to CVE-2025-63209. However, given the nature of the vulnerability – unauthenticated information disclosure leading to potential remote system compromise – it is expected to receive a High to Critical severity rating once a CVSS score is formally calculated. The ease of exploitation combined with the potential impact makes this a high-priority vulnerability.
Possible Impact
The potential impact of this vulnerability is significant. An attacker who successfully exploits CVE-2025-63209 can:
- Gain complete administrative control of the ELCA Star Transmitter.
- Modify system settings, potentially disrupting normal operations.
- Use the compromised transmitter as a pivot point to attack other systems on the network.
- Potentially cause physical damage or disruptions if the transmitter controls critical infrastructure.
Mitigation and Patch Steps
Until a patch is released by ELCA Radio, the following mitigation steps are recommended:
- Network Segmentation: Isolate the ELCA Star Transmitter on a separate network segment with restricted access.
- Access Control Lists (ACLs): Implement ACLs to limit access to the transmitter’s web interface and prevent unauthorized access to the
/setup.xmlendpoint. - Monitor Network Traffic: Monitor network traffic for any unusual activity related to the ELCA Star Transmitter.
- Contact ELCA Radio: Contact ELCA Radio and request a security patch for this vulnerability. Pressure from users can accelerate the release of a fix.
- Disable Remote Access (If Possible): If remote access isn’t absolutely required, disable it to eliminate the attack vector.
Stay Updated: Monitor ELCA Radio’s website and security advisories for updates and patches related to CVE-2025-63209. Apply any available patches immediately.
References
- CVE ID: CVE-2025-63209
- CVE-2025-63209 Vulnerability Research Details
- ELCA Radio Website
