CVE-2025-57175 is a vulnerability in Siklu EtherHaul 8010 devices running firmware version siklu-uimage-nxp-enc-10_6_2-18707-ea552dc00b, where a static root password is hard-coded into the device. This weakness (CWE-259) allows potential unauthorized access with high privileges if an attacker can reach the device over the network. The vulnerability has a CVSS 3.1 score of 6.4, reflecting medium severity with high impact on confidentiality, integrity, and availability, but requires high attack complexity and no privileges or user interaction. No vendor patch or official remediation has been documented.

An attacker with network access to the affected Siklu EtherHaul 8010 device could leverage the hard-coded root password to gain full administrative control. This could lead to complete compromise of the device, including unauthorized disclosure, modification, or disruption of device functions. The vulnerability impacts confidentiality, integrity, and availability at a high level. However, exploitation requires network access and has high complexity, limiting ease of attack. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict network access to the affected devices to trusted administrators only and monitor for unauthorized access attempts. Consider network segmentation or additional access controls to limit exposure. Avoid deploying affected firmware versions in sensitive environments where possible.