CVE-2025-0697 Telstra Smart Modem Gen 2 HTTP Header injection
Remote attackers can inject content into HTTP headers via the Content-Disposition argument in Telstra Smart Modem Gen 2 devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-0697?
CVE-2025-0697 is a medium-severity vulnerability in Telstra Smart Modem Gen 2, published on 24 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability, which was classified as problematic, was found in Telstra Smart Modem Gen 2 up to 20250115. This affects an unknown part of the component HTTP Header Handler. The manipulation of the argument Content-Disposition leads to injection. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Which versions are affected by CVE-2025-0697?
How do I fix CVE-2025-0697?
No fix has been published for CVE-2025-0697 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-0697 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-0697 exists.
Sources
Also known as GHSA-rpcx-p9vc-6cq7.