Listen to this Post
The vulnerability CVE-2025-12917 targets TOZED ZLT T10 T10PLUS firmware version 3.04.15, specifically within the Reboot Handler component. It involves an unknown function in the file /reqproc/proc_post, which is accessible via HTTP requests on the local network. Attackers can send crafted POST requests to this endpoint, triggering a manipulation that leads to a denial of service (DoS) condition. The flaw likely stems from improper input validation or error handling in the reboot processing logic, causing the device to crash or become unresponsive. Since the exploit is publicly available, malicious actors can use simple network tools to send malicious payloads, requiring only access to the same local network as the device. The vulnerability does not require authentication, making it easy to exploit. The DoS effect may involve device reboots, service interruptions, or permanent instability until manual intervention. Technical analysis suggests the `proc_post` function fails to handle certain parameters or oversized data, leading to buffer overflows or infinite loops. This can be exploited repeatedly to maintain DoS, affecting device availability. Network scanning can identify vulnerable devices on ports serving the web interface. The vendor has not provided patches or responses, increasing the risk for deployed devices.
Platform: TOZED ZLT T10PLUS
Version: 3.04.15
Vulnerability: Denial of Service
Severity: MEDIUM
date: 11/09/2025
Prediction: Patch date unknown
What Undercode Say:
Analytics
curl -X POST http://<target>/reqproc/proc_post -d "data=malicious_payload" nmap -p 80,443 <local_network_range> --script http-vuln-cve2025-12917 python3 exploit.py --target <ip> --dos
How Exploit:
Send crafted HTTP POST request to `/reqproc/proc_post` with malicious data causing buffer overflow or loop, triggering device crash via local network access.
Protection from this CVE:
Disable unused services, network segmentation, firewall rules blocking unauthorized access to /reqproc/proc_post, monitor for anomalous POST requests.
Impact:
Device unavailability, service disruption, requiring physical reboot or reset.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
