The Eurolab ELTS100_UBX device (firmware version ELTS100v1.UBX) is vulnerable to Broken Access Control due to missing authentication on critical administrative endpoints. Attackers can directly access and modify sensitive system and network configurations, upload firmware, and execute unauthorized actions without any form of authentication. This vulnerability allows remote attackers to fully compromise the device, control its functionality, and disrupt its operation.
References
| Link | Resource |
|---|---|
| http://eurolab-srl.com/ | Product |
| https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63225_Eurolab_ELTS100_UBX_Broken_Access_Control | Exploit Third Party Advisory Mitigation |
Configurations
Configuration 1 (hide)
| AND |
|
History
04 Feb 2026, 20:54
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Eurolab-srl elts 100
Eurolab-srl elts 100 Firmware Eurolab-srl |
|
| CPE | cpe:2.3:o:eurolab-srl:elts_100_firmware:elts100v1.ubx:*:*:*:*:*:*:* cpe:2.3:h:eurolab-srl:elts_100:e118:*:*:*:*:*:*:* |
|
| References | () http://eurolab-srl.com/ - Product | |
| References | () https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63225_Eurolab_ELTS100_UBX_Broken_Access_Control - Exploit, Third Party Advisory, Mitigation |
19 Nov 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CWE | CWE-284 |
18 Nov 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-18 19:15
Updated : 2026-02-04 20:54
NVD link : CVE-2025-63225
Mitre link : CVE-2025-63225
CVE.ORG link : CVE-2025-63225
JSON object : View
Products Affected
eurolab-srl
- elts_100_firmware
- elts_100
CWE
CWE-284
Improper Access Control