External risk intelligence

Longwatch Devices Arbitrary Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-13658

Longwatch devices function as industrial monitoring systems often deployed with network interfaces to facilitate remote data access and management. The presence of an exposed HTTP endpoint that accepts unauthenticated requests indicates a configuration commonly accessible via network segments where such devices are deployed for monitoring purposes, making them a likely candidate for exposure.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in Longwatch devices that allows unauthorized code execution through an exposed HTTP endpoint, potentially granting system-level privileges. This issue is noteworthy because it affects devices used in monitoring systems and bypasses standard security controls like code signing. The primary leadership concern is to confirm if these specific devices are in use and assess their potential exposure.

Unauthenticated code execution in monitoring devices.
Potential for SYSTEM-level access by attackers.
Confirm device presence and exposure risk.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending an unauthenticated HTTP GET request to an exposed endpoint on vulnerable Longwatch devices. The absence of code signing and execution controls allows for arbitrary code execution, potentially leading to SYSTEM-level privileges on the affected device.

Network access to an exposed endpoint.
Sending an unauthenticated HTTP GET request.
Arbitrary code execution with SYSTEM privileges.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code on Longwatch devices, leading to SYSTEM-level privileges when supported by the advisory.

Arbitrary code execution on devices.
Unauthenticated HTTP GET requests to an exposed endpoint.
Compromised device and potential system impact.

Operational Fix

Recommended remediation, mitigation, and detection steps

The exploitation of this vulnerability likely requires coordination between the asset owner responsible for the Longwatch devices and the network or security teams. The first practical step is to identify all deployed Longwatch devices, determine their network exposure and business criticality, and confirm the accountable owner before planning remediation.

Asset owners must own the remediation effort.
Verify device network reachability and criticality.
Plan coordinated vendor engagement and patching.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What are Longwatch devices used for?

Longwatch devices are specialized components used for industrial monitoring. They are typically deployed to collect and manage data from physical systems, providing remote visibility into industrial operations. By design, they often include network interfaces to allow operators to access monitoring data and manage system settings from a distance.

What does CWE-94 mean in the context of CVE-2025-13658?

CWE-94 refers to improper control of code generation or execution. In this vulnerability, it means the system lacks necessary safeguards—specifically code signing and execution controls—when processing incoming data. Because these checks are missing, the device will accept and run unauthorized instructions sent to it, potentially granting an attacker the highest level of control over the device.

How is CVE-2025-13658 triggered?

An attacker triggers this bug by sending a specifically crafted, unauthenticated HTTP GET request to an exposed endpoint on the device. Because the system does not require authentication or verify the integrity of the request, it processes the command as a legitimate instruction. Simply interacting with other, non-exposed parts of the device or sending standard administrative traffic that does not target this specific endpoint does not trigger the vulnerability.

Why should I care about CVE-2025-13658?

You should care if you manage these devices in your network. Halo Surface Signal identifies these as likely candidates for exposure because they are often deployed with network interfaces to facilitate remote access. If your devices are reachable over the network, they could be accessed by unauthorized parties, making assessment of your internal versus internet-facing infrastructure a priority.

What is the first step to address this issue?

The immediate priority is to identify every Longwatch device within your environment. Once you have a complete inventory, verify how each device is connected to the network and determine its business importance. Consult with your security or network teams to confirm the device owner, as they will need to coordinate the next steps for vendor engagement and remediation.

References

www.cisa.gov/news-events/ics-advisories/icsa-25-336-01

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.