External risk intelligence

Itel DAB Encoder Authentication Bypass via Reused JWT

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-63224

The Itel DAB Encoder is a network-connected appliance used for broadcasting or signal processing. These devices are frequently deployed as edge gateways or managed remotely over network interfaces. Given their role in infrastructure, they are commonly reachable via network management interfaces, making them likely to be exposed to external or internal networks.

Authentication Bypass

Itel Idenc Firmware

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects the Itel DAB Encoder, a device used for signal processing. It allows attackers to bypass authentication and gain administrative control over any device using a stolen token, regardless of network or password differences. This could lead to a full compromise of affected devices.

Bypass device security with stolen credentials.
Impacts devices controlling critical infrastructure.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

Attackers can bypass authentication in the Itel DAB Encoder by obtaining a valid JSON Web Token (JWT) from one device and reusing it to gain administrative control over any other device running the same firmware. This allows them to fully compromise affected devices without needing legitimate credentials or network access to the target device.

Entry: Obtain a valid JWT token.
Trigger: Reuse the token on another device.
Risk: Full device compromise and administrative access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to bypass authentication on any Itel DAB Encoder device by reusing a valid JWT token. This could lead to unauthorized access and full compromise of affected devices, impacting their normal operation and any data or services they manage.

Administrative access to devices.
Reusing a stolen authentication token.
Unauthorized control of device functions.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Itel DAB Encoder's authentication bypass vulnerability requires identification of all deployed devices. Since any valid token can grant administrative access across devices, platform or infrastructure teams should coordinate with network and security teams to locate affected appliances. The first practical step is to discover all instances, assess their network exposure and business criticality, and identify the accountable owner for planning remediation.

Identify accountable technical owner.
Verify device network exposure.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Itel DAB Encoder?

The Itel DAB Encoder is a specialized hardware appliance used for signal processing and digital audio broadcasting. These devices typically function as edge gateways within infrastructure environments to manage, encode, and transmit signal data across networks.

What does CWE-287 and CWE-384 mean for CVE-2025-63224?

These designations identify Improper Authentication (CWE-287) and Session Fixation or mismanagement (CWE-384). In this context, the encoder fails to properly validate the scope of JSON Web Tokens. Because the system accepts a token generated for one device as valid for others, an attacker can hijack administrative sessions across the entire product line.

How can an attacker trigger this authentication bypass?

The vulnerability is triggered by reusing a valid JWT token obtained from one Itel DAB Encoder on a different device running the same firmware. An attacker does not need to guess passwords or exploit the local network of the target. Note that this bug is not triggered by standard login attempts, but specifically by injecting a cross-device authentication token.

Is my Itel DAB Encoder at risk if it is not on the public internet?

According to Halo Surface Signal, these encoders are often deployed as managed appliances with network interfaces. Even if a device is not directly facing the public internet, it may remain reachable via internal networks. If an attacker gains a foothold elsewhere in your infrastructure, they can use that access to target these internal management interfaces.

What should I do if I manage Itel DAB Encoder units?

Your first step is to create a complete inventory of all deployed encoders in your environment. Once identified, evaluate the network accessibility of each unit and coordinate with your infrastructure team to isolate management interfaces. Determine the business criticality of each device to prioritize further security hardening or vendor-provided updates as they become available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.