PT-2025-50753 · Siklu · Siklu Multihaul Tg

Semaja2 · Published 2025-12-11 · Updated 2025-12-12 · CVE-2024-58300

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Siklu MultiHaul TG series versions prior to 2.0.0

Description Siklu MultiHaul TG series devices are affected by an issue that allows remote attackers to retrieve randomly generated credentials via a network request without authentication. An attacker can send a specific hex-encoded command to port 12777 to obtain the username and password, which enables direct SSH access to the device.

Recommendations Update Siklu MultiHaul TG series devices to version 2.0.0 or later.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2024-58300

Affected Products

Siklu Multihaul Tg

References · 5

• 🔥 https://exploit-db.com/exploits/51932 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-58300 · Security Note
• https://siklu.com · Note
• https://vulncheck.com/advisories/siklu-multihaul-tg-series-unauthenticated-credential-disclosure-vulnerability · Note
• https://t.me/CVEtracker/39531 · Telegram Post