PT-2025-48041 · Syrotech · Sy-Gpon-1110-Wdont

Yashodhanvivek · Published 2025-11-25 · Updated 2025-11-30 · CVE-2025-63729

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Syrotech SY-GPON-1110-WDONT SYRO 3.7L 3.1.02-240517

Description An issue exists in Syrotech SY-GPON-1110-WDONT firmware where an attacker can extract the SSL Private Key, CA Certificate, SSL Certificate, and Client Certificates in .pem format from the etc folder.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Insertion into Log File

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-200

CWE-532

CWE-312

Related Identifiers

CVE-2025-63729

Affected Products

Sy-Gpon-1110-Wdont

References · 6

• 🔥 https://github.com/Yashodhanvivek/CVE-2025-63729-Syrotech-SY-GPON-1110-/blob/main/Syrotech_SY-GPON-1110-WDONT_Security_Assessment.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-63729 · Security Note
• https://osv.dev/vulnerability/CVE-2025-63729 · Vendor Advisory
• https://twitter.com/CVEnew/status/1993362188988461476 · Twitter Post
• https://t.me/CVEtracker/38191 · Telegram Post
• https://twitter.com/cracbot/status/1995085463691186476 · Twitter Post