CVE-2025-29268

published 2025-12-04

CVE-2025-29268: ALLNET ALL-RUT22GW v3.3.8 was discovered to store hardcoded credentials in the libicos.so library.

Priority P2 62 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

ALLNET ALL-RUT22GW v3.3.8 was discovered to store hardcoded credentials in the libicos.so library.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
allnet	all-rut22gw_firmware	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /api/login

other user=iwu@fbt&ND

other pass=wut@uty&2210

path libicos.so↗

snort

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Allnet ALL-RUT22GW 4G LTE Cellular Router Hardcoded Backdoor Credentials (CVE-2025-29268)"; flow:established,to_server; http.uri; content:"/api/login"; startswith; http.request_body; url_decode; content:"user|3d|iwu@fbt&ND"; fast_pattern; content:"pass|3d|wut@uty&2210"; reference:url,blog.byteray.co.uk/critical-vulnerabilities-in-rut22gw-industrial-lte-cellular-routers-f4eb8768feb7; reference:cve,2025-29268; classtype:web-application-attack; sid:2066034; rev:1; metadata:attack_target Server, tls_state TLSDecrypt, created_at 2025_12_05, cve CVE_2025_29268, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence High, signature_severity Major, tag Exploit, updated_at 2025_12_05, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

• → Exploit traffic targets the /api/login endpoint via HTTP POST with URL-decoded body containing the hardcoded backdoor username 'iwu@fbt&ND' and password 'wut@uty&2210'; match both fields together to reduce false positives.
• → Detection should be deployed at the perimeter, internally, and on TLS-decrypting inspection points (SSLDecrypt/TLSDecrypt) as the rule metadata explicitly calls out all three deployment contexts.
• → The hardcoded credentials are stored in the libicos.so shared library on the device; forensic analysis of this file on a suspect device can confirm the presence of the backdoor. ↗
• → MITRE mapping: Initial Access (TA0001) via Exploit Public-Facing Application (T1190); prioritise alerting on inbound exploitation attempts against internet-exposed ALL-RUT22GW management interfaces.

• · The Snort/Suricata rule (sid:2066034) requires TLS inspection to be effective against HTTPS-protected management interfaces; without TLSDecrypt the rule will not fire on encrypted sessions.
• · The affected firmware version is v3.3.8; verify device firmware version before applying detections to avoid scope creep across unaffected hardware. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-798