PT-2025-47410 · Itel · Itel Dab Mux

Published 2025-11-18 · Updated 2025-11-19 · CVE-2025-63217

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Itel DAB MUX versions (affected versions not specified)

Description The Itel DAB MUX (IDMUX build c041640a) has a flaw in how it verifies JWT (JSON Web Token) authentication. This allows an attacker who has a valid JWT token from one device to use it to gain administrative access to any other device running the same firmware, regardless of the passwords or network configurations. This can lead to a complete compromise of the affected devices. The issue stems from improper JWT validation across devices.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-63217

Affected Products

Itel Dab Mux

References · 7

• 🔥 https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63217%20_%20Itel%20DAB%20MUX%20Authentication%20Bypass · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-63217 · Security Note
• https://t.me/CVEtracker/37680 · Telegram Post
• https://itel.it · Note
• https://twitter.com/VulmonFeeds/status/1990982011587084570 · Twitter Post
• https://t.me/cveNotify/143365 · Telegram Post
• https://twitter.com/CVEnew/status/1991043003842969919 · Twitter Post