VULNERABILITY INTELLIGENCE
CVE-2025-57176
CVSS score6.5 MEDIUM
EPSS probability0.41%
CISA KEVNot currently listed
Published2025-09-15
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Description
On Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpiped service on TCP port 555 allows unauthenticated file uploads to any writable location on the device. File upload packets use weak encryption (metadata only) with file contents transmitted in cleartext. No authentication or path validation is performed.
Weakness classification
- cve@mitre.org: CWE-434
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-434