External risk intelligence

Audi UTR 2.0 FTP Authentication Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2025-45583

The vulnerability exists in the FTP service of the Audi Universal Traffic Recorder, which is a physical automotive hardware device. Such devices are designed for vehicle-local operation and are not intended to be exposed to the public internet in common deployments.

Authentication Bypass

Audi Universal Traffic Recorder Firmware

1.52

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability affects Audi Universal Traffic Recorder devices, specifically their FTP service. The flaw allows unauthorized access without proper credentials, potentially exposing sensitive system information. The main concern is confirming whether these devices are deployed in a manner that exposes them to this risk.

Flaw allows unauthorized FTP access.
Matters if devices are internet-exposed.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can remotely access the Audi Universal Traffic Recorder's FTP service due to flawed access controls. This allows them to log in using any credentials, potentially leading to unauthorized access and modification of sensitive data.

Unauthenticated network access required.
Flawed FTP access control is triggered.
Unauthorized access to device data.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthorized access to the Audi UTR 2.0 Universal Traffic Recorder's FTP service by bypassing authentication. When supported, this could expose system data or allow modification of service behavior.

System data and service configurations at risk.
Attackers can bypass FTP authentication.
Unauthorized access and potential data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Audi Universal Traffic Recorder's FTP service is vulnerable to unauthorized access due to weak access controls. Identifying and assessing the exposure of these recorders is the crucial first step. Owners must determine if the affected devices are accessible externally or are business-critical, then find the accountable party to plan a risk-based remediation strategy.

Identify affected devices and owners.
Verify external reachability and criticality.
Plan remediation based on verified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Audi Universal Traffic Recorder?

The Audi Universal Traffic Recorder is a hardware device installed in vehicles to capture and store video footage and telematics data. The software component in question, the UTR 2.0 firmware, manages device operations, including an FTP service used to facilitate the transfer and management of these recorded files.

What does CWE-287 mean for CVE-2025-45583?

CWE-287 refers to improper authentication. In the context of this vulnerability, it means the FTP service on the device fails to correctly verify the identity of a user attempting to connect. Because of this weakness, the system accepts any combination of username and password, effectively bypassing the security gate intended to prevent unauthorized access.

How is this FTP authentication bypass triggered?

An attacker triggers this flaw by initiating an FTP connection to the device's service and providing arbitrary credentials. The vulnerability is not triggered by legitimate, authenticated use or by interactions with the device's other non-FTP interfaces. Success depends entirely on the ability of the attacker to reach the FTP service over the network.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal assesses the likelihood of this risk as very unlikely for most users. Because the Audi Universal Traffic Recorder is a physical automotive component, it is designed for local operation within the vehicle, not for exposure to the public internet. If your device is not reachable from the internet, it remains shielded from this specific network-based attack vector.

Do I need to take action if I use this hardware?

Yes, you should begin by confirming where and how your devices are deployed. The priority is to verify that these recorders are not reachable from external networks. Once you understand your deployment, locate the responsible technical or administrative contact within your organization to discuss and coordinate appropriate risk management steps.

References

2barbie.notion.site/2024-Audi-UTR-2-0-Report-1bff0be688c680cb8795efe78732…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.