# CVE-2025-0674: Signum DVB-S/S2 IRD - Authentication Bypass

> Live exploitation tracking for CVE-2025-0674 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-0674

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.3
- **Public exploit available:** Yes
- **Affected products:** Elber Signum DVB-S/S2 IRD, Elber Cleber/3 Broadcast Multi-Purpose Platform, Elber Reble610 M/ODU XPIC IP-ASI-SDH, Elber ESE DVB-S/S2 Satellite Receiver, Elber Wayber Analog/Digital Audio STL
- **Weaknesses:** CWE-288 (Authentication Bypass Using an Alternate Path or Channel)
- **Tags:** iot

## Description

Multiple Elber products are affected by an authentication bypass 
vulnerability which allows unauthorized access to the password 
management functionality. Attackers can exploit this issue by 
manipulating the endpoint to overwrite any user's password within the 
system. This grants them unauthorized administrative access to protected
 areas of the application, compromising the device's system security.

## CrowdSec analysis

[CVE-2025-0674](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-0674) is a critical authentication bypass vulnerability impacting multiple Elber products, including the Signum DVB-S/S2 IRD and others. This flaw allows attackers to manipulate endpoints and overwrite any user's password, granting unauthorized administrative access to protected areas of the affected devices. Exploitation of this vulnerability could lead to full system compromise, enabling attackers to control device functionality and potentially disrupt broadcast or communication services.

CrowdSec has been tracking this vulnerability and its exploits since 15th of April 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-0674 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit authentication bypass by sending requests to `/modules/pwd.html` and `/json_data/set_pwd` endpoints, allowing unauthorized access to password management and enabling them to reset user credentials without authentication.

## Timeline

- 2025-02-06: CVE Published. CVE-2025-0674 is published to NVD.
- 2026-04-15: Rule Released. CrowdSec releases a rule to detect CVE-2025-0674 exploitation attempts against the CrowdSec Network.

## References

- https://www.cisa.gov/news-events/ics-advisories/icsa-25-035-03
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-0674.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-0674) follows observed exploitation activity for CVE-2025-0674. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.