External risk intelligence

NETLINK HG322G Authentication Bypass Privilege Escalation

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-60772

The vulnerability exists in the web-based management interface of a network device (GPON ONT). Such interfaces are commonly exposed on edge gateways or management surfaces. While often intended for local network access, these portals are frequently reachable from the internet in common deployment scenarios for remote management or due to misconfiguration.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability affects NETLINK's web management interface, allowing unauthorized access to escalate privileges and potentially lock out administrators. The exposure of this interface to the internet means that remote, unauthenticated attackers could exploit this weakness to gain control of the device, impacting its availability and confidentiality.

Unauthenticated attackers can take over device management.
Critical flaw impacts remote device administration access.
Confirm relevance and exposure for network devices.

Attack Path

How an attacker could exploit the issue

An attacker could reach the device's web management interface over the network and send specially crafted HTTP requests. This would allow them to bypass authentication, gain administrative control, and potentially lock out legitimate users.

No authentication needed to access.
Triggered by crafted HTTP requests.
Risk: unauthorized admin access, lockout.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to gain administrative control over the device's web interface. This might involve locking out the legitimate administrator, potentially disrupting device management and access.

Administrative access to the device.
Crafted HTTP requests.
Loss of administrative control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The NETLINK HG322G web management interface's improper authentication flaw requires immediate attention from teams managing network edge devices and the security operations center. The first practical step is to identify all deployed HG322G devices, confirm their exposure and criticality, and then coordinate remediation with the relevant network or infrastructure owners, potentially involving vendor coordination if a patch is unavailable.

Network or infrastructure owners should lead.
Verify device exposure and criticality.
Plan vendor-assisted remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the NETLINK HG322G device?

The NETLINK HG322G is a GPON ONT, which stands for Gigabit Passive Optical Network Optical Network Terminal. It functions as a gateway device typically used by internet service providers to deliver fiber-optic connectivity to homes and businesses. It acts as the bridge between the provider's fiber network and the local wired or wireless network, managing traffic and providing a web-based portal for administrative configuration.

What does improper authentication mean for CVE-2025-60772?

This vulnerability falls under the weakness class of Improper Authentication (CWE-287). It means the web management interface fails to correctly verify the identity of a user before granting access. Because of this flaw, the device treats unauthorized requests as if they came from an administrator, allowing an attacker to bypass the login process entirely and gain elevated control over the device settings.

How is this vulnerability triggered?

The flaw is triggered when an attacker sends specially crafted HTTP requests to the device's web management interface. No prior login or valid credentials are required to initiate the attack. Note that simply browsing the web or using the device for normal internet connectivity does not trigger this; the attack requires intentional, malicious HTTP traffic directed specifically at the management portal.

Do I need to worry if my device is on the internal network?

Halo Surface Signal indicates that while these portals are intended for local management, they are frequently reachable from the internet due to common deployment configurations. If your device's management interface is accessible via a public IP address, it is considered internet-facing and highly exposed. You should prioritize assessing whether your management interface is reachable from outside your local network.

How should I respond to this threat?

Begin by creating an inventory of all HG322G devices within your environment to understand your footprint. Verify which of these devices have their management interfaces exposed to the internet. Once identified, work with your network administrators to restrict access to these management portals. If you cannot disable remote management, coordinate with your vendor to determine if a firmware update is available to secure the authentication process.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.