External risk intelligence

Eurolab ELTS100 UBX Firmware Broken Access Control Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-63225

The device is an appliance with critical administrative endpoints that lack authentication. Given the nature of such devices being designed for network management and the specific exposure of unauthenticated administrative controls, this falls into the category of services that are often public-facing or reside on network edges by design.

Eurolab Srl Elts 100 Firmware

elts100v1.ubx

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical security flaw found in certain Eurolab ELTS100 devices. The vulnerability, stemming from a lack of authentication on important administrative functions, allows unauthorized individuals to remotely access, alter system configurations, and potentially disrupt the device's operation, leading to a full compromise.

Unauthenticated control over device settings.
Remote attackers can take full control.
Confirm device relevance and exposure.

Attack Path

How an attacker could exploit the issue

Attackers can remotely target the Eurolab ELTS100_UBX device by exploiting missing authentication on its administrative functions. This exposure allows an unauthenticated attacker to directly access critical endpoints, leading to the modification of system and network configurations, firmware uploads, and unauthorized actions, ultimately enabling full device compromise.

No authentication required.
Access administrative endpoints.
Full device compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow remote attackers to gain complete control over the Eurolab ELTS100_UBX device by accessing administrative functions without authentication. This could affect system and network configurations, potentially leading to unauthorized firmware uploads and disruption of the device's operation.

System and network configurations at risk.
Unauthorized access via critical endpoints.
Complete device compromise and disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Eurolab ELTS100_UBX device, with its critical administrative endpoints lacking authentication, is likely managed by a combination of infrastructure and security teams. The first actionable step is to identify all instances of this device, assess their network exposure and business criticality, and pinpoint the accountable owner for remediation planning.

Identify device owners and criticality.
Verify network exposure and access.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Eurolab ELTS100 device?

The Eurolab ELTS100 is a hardware appliance designed for system and network management tasks. It runs the ELTS100_UBX firmware, which facilitates operational controls. Because these devices often handle critical infrastructure settings, they serve as centralized points for configuring network behavior and administrative functions.

What does Broken Access Control mean for CVE-2025-63225?

This CVE involves a weakness classified as CWE-284, which means the system fails to enforce security restrictions on its administrative interfaces. Essentially, the software does not check who is asking for permission before granting access to sensitive functions, allowing anyone to reach those parts of the system as if they were an authorized administrator.

How do attackers trigger this vulnerability?

An attacker triggers this flaw by sending network requests directly to the device’s administrative endpoints. No special login or password is required to initiate these commands. It is important to note that this bug does not rely on exploiting a software crash or memory error; the vulnerability exists simply because the authentication step is entirely missing from the design of these specific pages.

Is my Eurolab device at risk?

If your device is connected to a network, it may be at risk. According to Halo Surface Signal, this device is considered very likely to be exposed because its administrative endpoints are often placed on network edges or made public-facing by design. If you can reach the device's management interface from an external network, it is effectively accessible to unauthorized parties.

What should I do if I use this software?

Your first step is to locate every instance of the ELTS100 in your environment to understand where they are deployed. Once identified, evaluate whether these devices are reachable from the internet or untrusted internal segments. After mapping your inventory and verifying their network exposure, work with the device owners to prioritize remediation and restrict access to these critical interfaces immediately.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.