Unrated

Authentication Bypass in Askey AP5100W Web Interface

IdentifiersCVE-2020-25546CWE-306

CVE-2020-25546 affects the Askey AP5100W Wi-Fi mesh node web management interface, tested on version Dual_SIG_1.01.071. The authentication implementation is reportedly flawed such that a successful administrator login sets a device-wide authenticated state rather than establishing a per-user session. The report states that no session keys or cookies are used, and once any legitimate user logs into the web interface, subsequent requests from other parties with access to the interface are treated as authenticated. This results in an authentication bypass condition for attackers on the local network or otherwise able to reach the management interface.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

An attacker who can access the AP5100W web interface can gain unauthorized administrative access after any legitimate administrator logs in. This can expose administrative functions and device settings to unauthorized manipulation. The issue can also be chained with other vulnerabilities affecting the same device, enabling broader compromise such as credential recovery and subsequent command execution.

Mitigation

If you can’t patch tonight, do this now.

Restrict access to the web management interface to trusted administrative hosts only, disable or firewall management access from untrusted LAN segments including guest networks, and change default credentials. Until patched firmware is deployed, administrators should avoid exposing the interface broadly on the local network and should segment management access to reduce the chance that an attacker can reach the interface and wait for a legitimate login event.

Remediation

Patch, then assume compromise.

Apply a vendor firmware update that corrects the authentication design by enforcing per-client authenticated sessions, using proper session identifiers, and validating authorization on every request. If an official fix is available from Askey or the service provider, upgrade affected AP5100W devices from vulnerable firmware such as Dual_SIG_1.01.071 to the patched release.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

starlabs sgNews

May 22, 2020

(CVE-2020-15357) Askey AP5100W Authenticated Command Injection in web Interface | STAR Labs

A vulnerability in the Askey AP5100W referenced as part of a chained exploit involving login-state checking and credential compromise, but not described in detail in this content.

starlabs sgNews

May 22, 2020

(CVE-2020-25546) Askey AP5100W Logic Error allowing Web Admin authentication bypass | STAR Labs

An authentication flaw in the Askey AP5100W web interface where authentication state appears to be globally set, allowing any user with network access to access the interface once any administrator has logged in.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity