{"id":"CVE-2025-53754","state":"PUBLISHED","title":"Hard-coded Credentials Vulnerability in Digisol DG-GR6821AC Router","description":"This vulnerability exists in Digisol DG-GR6821AC Router due to hard-coded Root Access Credentials in system configuration of the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and analyzing the binary data to obtain the stored root access credentials. \n\nSuccessful exploitation of this vulnerability could allow the attacker to gain admin access to the targeted device.","publishedAt":"2025-07-16T11:13:48.388Z","updatedAt":"2025-07-16T15:52:41.008Z","severity":{"score":5.1,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","source":"CERT-In"},"assigner":"CERT-In","products":["Digisol XPON ONU Wi-Fi Router (DG-GR6821AC)"],"affected":[{"vendor":"Digisol","product":"XPON ONU Wi-Fi Router (DG-GR6821AC)","defaultStatus":"unaffected","versions":[{"version":"V3.2.XX","status":"affected"}]}],"references":["https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0147"],"weaknesses":["CWE-798"],"ingestedAt":"2026-10-29T20:09:31.862Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/53xxx/CVE-2025-53754.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-53754","state":"PUBLISHED","datePublished":"2025-07-16T11:13:48.388Z","dateUpdated":"2025-07-16T15:52:41.008Z","assignerShortName":"CERT-In","assignerOrgId":"66834db9-ab24-42b4-be80-296b2e40335c","dateReserved":"2025-07-09T11:17:31.819Z"},"containers":{"cna":{"title":"Hard-coded Credentials Vulnerability in Digisol DG-GR6821AC Router","descriptions":[{"lang":"en","value":"This vulnerability exists in Digisol DG-GR6821AC Router due to hard-coded Root Access Credentials in system configuration of the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and analyzing the binary data to obtain the stored root access credentials. \n\nSuccessful exploitation of this vulnerability could allow the attacker to gain admin access to the targeted device."}],"affected":[{"vendor":"Digisol","product":"XPON ONU Wi-Fi Router (DG-GR6821AC)","defaultStatus":"unaffected","versions":[{"version":"V3.2.XX","status":"affected"}]}],"references":[{"url":"https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0147","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"PHYSICAL","baseScore":5.1,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-798","description":"CWE-798: Use of Hard-coded Credentials","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CERT-In","orgId":"66834db9-ab24-42b4-be80-296b2e40335c","dateUpdated":"2025-07-16T11:13:48.388Z"},"credits":[{"lang":"en","type":"finder","value":"This vulnerability is reported by Shravan Singh from Kavach IoT Security."}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Upgrade Digisol DG-GR6821AC Router firmware to version HG323DACv5_all_V3.2.02-250509_Digisolver<br>"}],"value":"Upgrade Digisol DG-GR6821AC Router firmware to version HG323DACv5_all_V3.2.02-250509_Digisolver"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-07-16T15:52:31.045391Z","id":"CVE-2025-53754","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-07-16T15:52:41.008Z"}}]}}}