CVE-2025-28233: n/a in n/a
Incorrect access control in BW Broadcast TX600 (14980), TX300 (32990) (31448), TX150, TX1000, TX30, and TX50 Hardware Version: 2, Software Version: 1.6.0, Control Version: 1.0, AIO Firmware Version: 1.7 allows attackers to access log files and extract session identifiers to execute a session hijacking attack.
AI Analysis
Technical Summary
CVE-2025-28233 is a critical vulnerability affecting multiple models of BW Broadcast hardware devices, specifically the TX600, TX300, TX150, TX1000, TX30, and TX50. These devices run Hardware Version 2, Software Version 1.6.0, Control Version 1.0, and AIO Firmware Version 1.7. The vulnerability arises from incorrect access control mechanisms that allow unauthorized attackers to access sensitive log files. These log files contain session identifiers, which can be extracted by the attacker to perform session hijacking attacks. The vulnerability is classified under CWE-284 (Improper Access Control), indicating that the devices fail to properly restrict access to sensitive resources. According to the CVSS v3.1 score of 9.1, this vulnerability is critical, with an attack vector of network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and impacts confidentiality and integrity at a high level (C:H/I:H), but does not affect availability (A:N). This means an attacker can remotely exploit this vulnerability without authentication or user interaction, making it highly dangerous. The exploitation allows attackers to hijack active sessions, potentially gaining unauthorized control or access to the device or connected systems. Although no known exploits are currently reported in the wild, the vulnerability's nature and ease of exploitation make it a significant threat. The lack of patch links suggests that a fix may not yet be publicly available, increasing the urgency for mitigation and monitoring. The affected devices are specialized broadcast hardware, likely used in media, telecommunications, or related industries where secure session management is critical.
Potential Impact
For European organizations, particularly those in the broadcasting, telecommunications, and media sectors, this vulnerability poses a severe risk. Unauthorized access to session identifiers can lead to session hijacking, allowing attackers to impersonate legitimate users or administrators. This can result in unauthorized control over broadcast equipment, manipulation or interception of broadcast content, leakage of sensitive operational data, and potential disruption of services. The confidentiality and integrity of broadcast streams and management interfaces are at risk, which could undermine trust and compliance with data protection regulations such as GDPR. Additionally, compromised broadcast infrastructure could be leveraged for further attacks within an organization's network or to spread misinformation. The criticality of this vulnerability is heightened by the fact that exploitation requires no authentication or user interaction, enabling remote attackers to act stealthily and at scale. Organizations relying on these BW Broadcast devices must consider the operational and reputational impacts of potential breaches, including regulatory penalties and loss of audience or customer confidence.
Mitigation Recommendations
Given the absence of publicly available patches, European organizations should implement immediate compensating controls. First, restrict network access to the affected devices by placing them behind firewalls or network segmentation, limiting exposure to trusted management networks only. Employ strict access control lists (ACLs) to block unauthorized IP addresses and protocols. Monitor network traffic for unusual access patterns or attempts to retrieve log files. Enable detailed logging and alerting on access to sensitive resources within the devices, if supported. Where possible, disable or restrict remote management interfaces until patches are available. Conduct regular audits of device firmware and software versions to identify and inventory vulnerable devices. Engage with the device vendor or supplier to obtain timelines for patches or firmware updates and request guidance on interim security measures. Additionally, implement session management best practices in the broader network environment, such as using multi-factor authentication for administrative access and employing network intrusion detection systems (NIDS) to detect session hijacking attempts. Finally, prepare incident response plans specific to broadcast infrastructure compromise to minimize impact if exploitation occurs.
Affected Countries
Germany, France, United Kingdom, Italy, Spain, Netherlands, Belgium, Sweden, Poland, Finland
CVE-2025-28233: n/a in n/a
Description
Incorrect access control in BW Broadcast TX600 (14980), TX300 (32990) (31448), TX150, TX1000, TX30, and TX50 Hardware Version: 2, Software Version: 1.6.0, Control Version: 1.0, AIO Firmware Version: 1.7 allows attackers to access log files and extract session identifiers to execute a session hijacking attack.
AI-Powered Analysis
Technical Analysis
CVE-2025-28233 is a critical vulnerability affecting multiple models of BW Broadcast hardware devices, specifically the TX600, TX300, TX150, TX1000, TX30, and TX50. These devices run Hardware Version 2, Software Version 1.6.0, Control Version 1.0, and AIO Firmware Version 1.7. The vulnerability arises from incorrect access control mechanisms that allow unauthorized attackers to access sensitive log files. These log files contain session identifiers, which can be extracted by the attacker to perform session hijacking attacks. The vulnerability is classified under CWE-284 (Improper Access Control), indicating that the devices fail to properly restrict access to sensitive resources. According to the CVSS v3.1 score of 9.1, this vulnerability is critical, with an attack vector of network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and impacts confidentiality and integrity at a high level (C:H/I:H), but does not affect availability (A:N). This means an attacker can remotely exploit this vulnerability without authentication or user interaction, making it highly dangerous. The exploitation allows attackers to hijack active sessions, potentially gaining unauthorized control or access to the device or connected systems. Although no known exploits are currently reported in the wild, the vulnerability's nature and ease of exploitation make it a significant threat. The lack of patch links suggests that a fix may not yet be publicly available, increasing the urgency for mitigation and monitoring. The affected devices are specialized broadcast hardware, likely used in media, telecommunications, or related industries where secure session management is critical.
Potential Impact
For European organizations, particularly those in the broadcasting, telecommunications, and media sectors, this vulnerability poses a severe risk. Unauthorized access to session identifiers can lead to session hijacking, allowing attackers to impersonate legitimate users or administrators. This can result in unauthorized control over broadcast equipment, manipulation or interception of broadcast content, leakage of sensitive operational data, and potential disruption of services. The confidentiality and integrity of broadcast streams and management interfaces are at risk, which could undermine trust and compliance with data protection regulations such as GDPR. Additionally, compromised broadcast infrastructure could be leveraged for further attacks within an organization's network or to spread misinformation. The criticality of this vulnerability is heightened by the fact that exploitation requires no authentication or user interaction, enabling remote attackers to act stealthily and at scale. Organizations relying on these BW Broadcast devices must consider the operational and reputational impacts of potential breaches, including regulatory penalties and loss of audience or customer confidence.
Mitigation Recommendations
Given the absence of publicly available patches, European organizations should implement immediate compensating controls. First, restrict network access to the affected devices by placing them behind firewalls or network segmentation, limiting exposure to trusted management networks only. Employ strict access control lists (ACLs) to block unauthorized IP addresses and protocols. Monitor network traffic for unusual access patterns or attempts to retrieve log files. Enable detailed logging and alerting on access to sensitive resources within the devices, if supported. Where possible, disable or restrict remote management interfaces until patches are available. Conduct regular audits of device firmware and software versions to identify and inventory vulnerable devices. Engage with the device vendor or supplier to obtain timelines for patches or firmware updates and request guidance on interim security measures. Additionally, implement session management best practices in the broader network environment, such as using multi-factor authentication for administrative access and employing network intrusion detection systems (NIDS) to detect session hijacking attempts. Finally, prepare incident response plans specific to broadcast infrastructure compromise to minimize impact if exploitation occurs.
For access to advanced analysis and higher rate limits, contact root@offseq.com
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- mitre
- Date Reserved
- 2025-03-11T00:00:00.000Z
- Cisa Enriched
- true
Threat ID: 682d984ac4522896dcbf751c
Added to database: 5/21/2025, 9:09:30 AM
Last enriched: 6/21/2025, 1:23:42 PM
Last updated: 8/15/2025, 10:02:16 AM
Views: 11
Related Threats
CVE-2025-9019: Heap-based Buffer Overflow in tcpreplay
LowCVE-2025-9017: Cross Site Scripting in PHPGurukul Zoo Management System
MediumCVE-2025-9051: SQL Injection in projectworlds Travel Management System
MediumCVE-2025-1929: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Risk Yazılım Teknolojileri Ltd. Şti. Reel Sektör Hazine ve Risk Yönetimi Yazılımı
HighCVE-2025-54475: CWE-89: Improper Neutralization of Special Elements used in an SQL Command in joomsky.com JS Jobs component for Joomla
HighActions
Updates to AI analysis are available only with a Pro account. Contact root@offseq.com for access.
External Links
Need enhanced features?
Contact root@offseq.com for Pro access with improved analysis and higher rate limits.