CVE-2025-57176

State: Published
Severity: 6.5 Medium
Published: Sep 15, 2025
Updated: Mar 11, 2026
Reserved: Aug 17, 2025

Description

On Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpiped service on TCP port 555 allows unauthenticated file uploads to any writable location on the device. File upload packets use weak encryption (metadata only) with file contents transmitted in cleartext. No authentication or path validation is performed.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	mitre
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N	CISA-ADP

Weaknesses

CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
EtherHaul and MultiHaul Series microwave antennasCeragon Networks / Siklu Communication	Ceragon MultiHaul MH-B100-CCS to before R2.4.0Affected Ceragon MultiHaul MH-T200-CCC to before R2.4.0Affected Ceragon MultiHaul MH-T200-CNN to before R2.4.0Affected Ceragon MultiHaul MH-T201-CNN to before R2.4.0Affected Ceragon EtherHaul EH-8010FX to before R10.8.1Affected Ceragon EtherHaul EH-500TX to before R7.7.12Affected Ceragon EtherHaul EH-600TX to before R7.7.12Affected Ceragon EtherHaul EH-614TX to before R7.7.12Affected Ceragon EtherHaul EH-700TX to before R7.7.12Affected Ceragon EtherHaul EH-710TX to before R7.7.12Affected Ceragon EtherHaul EH-1200TX to before R7.7.12Affected Ceragon EtherHaul EH-1200FX to before R7.7.12Affected Ceragon EtherHaul EH-2200FX to before R7.7.12Affected Ceragon EtherHaul EH-2500FX to before R7.7.12Affected Ceragon EtherHaul EH-5500FD to before R7.7.12Affected

Product

Versions

EtherHaul and MultiHaul Series microwave antennasCeragon Networks / Siklu Communication

Ceragon MultiHaul MH-B100-CCS to before R2.4.0Affected
Ceragon MultiHaul MH-T200-CCC to before R2.4.0Affected
Ceragon MultiHaul MH-T200-CNN to before R2.4.0Affected
Ceragon MultiHaul MH-T201-CNN to before R2.4.0Affected
Ceragon EtherHaul EH-8010FX to before R10.8.1Affected
Ceragon EtherHaul EH-500TX to before R7.7.12Affected
Ceragon EtherHaul EH-600TX to before R7.7.12Affected
Ceragon EtherHaul EH-614TX to before R7.7.12Affected
Ceragon EtherHaul EH-700TX to before R7.7.12Affected
Ceragon EtherHaul EH-710TX to before R7.7.12Affected
Ceragon EtherHaul EH-1200TX to before R7.7.12Affected
Ceragon EtherHaul EH-1200FX to before R7.7.12Affected
Ceragon EtherHaul EH-2200FX to before R7.7.12Affected
Ceragon EtherHaul EH-2500FX to before R7.7.12Affected
Ceragon EtherHaul EH-5500FD to before R7.7.12Affected

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-04

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.