CVE-2025-57175

CVE-2025-57175 affects Siklu EtherHaul 8010 devices running firmware version nxp-enc-10_6_2-18707 and later, which contain a static root password hardcoded into the system. This configuration flaw allows unauthorized administrative access to affected wireless backhaul equipment. The vulnerability represents a significant authentication bypass that could compromise network infrastructure security. The vulnerability carries a CVSS score of 6.4 (Medium severity) with a physical attack vector, meaning an attacker must have direct access to the device. However, once physical access is obtained, the attack complexity is high but requires no user interaction or privileges to exploit, resulting in high impact across confidentiality, integrity, and availability. The static credential weakness is particularly concerning given the critical role these devices play in network connectivity. Currently, this vulnerability shows no signs of active exploitation in the wild, with an exceptionally low EPSS score of 0.00024 indicating minimal real-world exploitation probability. The vulnerability has not been added to the KEV catalog and remains inactive on threat intelligence hot lists. However, organizations operating Siklu EtherHaul 8010 equipment should prioritize firmware updates and implement physical security controls to restrict unauthorized device access.