PT-2025-47409 · Itel · Itel Dab Gateway

Published 2025-11-18 · Updated 2025-11-19 · CVE-2025-63216

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Itel DAB Gateway versions c041640a

Description The Itel DAB Gateway is susceptible to an authentication bypass due to inadequate JWT (JSON Web Token) validation. An attacker can exploit this by reusing a valid JWT token acquired from one device to authenticate and obtain administrative access to any other device running the same firmware, regardless of differing passwords or network configurations. This allows for complete compromise of the affected devices. JWT is a standard for securely transmitting information between parties as a JSON object.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Session Fixation

Weakness Enumeration

CWE-287

CWE-384

Related Identifiers

CVE-2025-63216

Affected Products

Itel Dab Gateway

References · 7

• 🔥 https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63216_Itel%20DAB%20Gateway%20Authentication%20Bypass · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-63216 · Security Note
• https://twitter.com/CVEnew/status/1991043002710593894 · Twitter Post
• https://itel.it · Note
• https://t.me/CVEtracker/37679 · Telegram Post
• https://t.me/cveNotify/143364 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1990987132182102274 · Twitter Post