I-O DATA UD-LT2 hybrid LTE router contains OS command injection and undocumented feature…

21 January 2025 high vulnerability

I-O DATA UD-LT2 hybrid LTE router contains OS command injection and undocumented feature vulnerabilities enabling arbitrary command execution and firewall bypass.

Japan's IPA has published an advisory regarding multiple vulnerabilities in the UD-LT2 hybrid LTE router manufactured by I-O DATA Device, Inc. The device contains three distinct vulnerabilities: two OS command injection flaws (CVE-2025-20617, CVE-2025-23237) and an undocumented feature vulnerability (CVE-2025-22450). Successful exploitation could allow attackers to execute arbitrary OS commands on the device or disable the firewall and modify device configurations.

The vulnerabilities affect UD-LT2 firmware version 1.00.008_SE and earlier. CVSS v3 severity ratings place CVE-2025-22450 at 7.5 (Important), CVE-2025-20617 at 7.2 (Important), and CVE-2025-23237 at 6.6 (Medium). I-O DATA has released firmware version 1.00.011_SE to address all three vulnerabilities.

Organizations using affected UD-LT2 routers should immediately update to firmware version 1.00.011_SE or later. Given that this is an internet-facing edge device with command injection vulnerabilities, rapid patching is essential to prevent potential compromise of network perimeters.

Mentioned in this report

Vulnerabilities CVE-2025-20617CVE-2025-22450CVE-2025-23237

Detection guidance

Web Server Process Spawning Shell with Command Injection Metacharacters (Embedded/Router Device)

ATT&CK T1059

Detects a device's web management daemon spawning a shell interpreter with command separator/metacharacters in the command line, consistent with OS command injection exploitation of router web interfaces (e.g. UD-LT2 CVE-2025-20617/CVE-2025-23237). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Process Spawning Shell with Command Injection Metacharacters
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - httpd
    - lighttpd
    - boa
    - goahead
    - uhttpd
    - cgi
  selection_shell:
    Image|endswith:
    - /sh
    - /bash
    - /busybox
  selection_injection:
    CommandLine|contains:
    - ;
    - '&&'
    - '|'
    - '`'
    - $(
    - '>'
  filter:
    CommandLine|contains:
    - logrotate
    - cron
  condition: selection_parent and selection_shell and selection_injection and not
    filter
falsepositives:
- Legitimate CGI scripts that shell out to helper binaries using benign fixed arguments
- Vendor firmware update or diagnostic scripts invoked from the web UI with static
  commands
level: high
tags:
- attack.t1059
- attack.execution
id: 3e31e1ec-0399-502b-80c8-6c36c783b99c
status: experimental
author: Vorant

Firewall Rule Flush or Disable Command Executed by Web/Management Process (Router Impair Defenses)

ATT&CK T1562.004

Detects execution of firewall management utilities (iptables/nftables/ufw) with flush/disable arguments spawned from a router's web management or remote administration process, consistent with the UD-LT2 undocumented-feature vulnerability (CVE-2025-22450) used to disable the device firewall. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Firewall Flush or Disable Command from Router Management Process
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - httpd
    - lighttpd
    - boa
    - goahead
    - uhttpd
    - telnetd
    - cgi
  selection_fw_tool:
    Image|endswith:
    - /iptables
    - /ip6tables
    - /nft
    - /ufw
  selection_disable_args:
    CommandLine|contains:
    - -F
    - --flush
    - disable
    - stop
    - DROP
    - ACCEPT
  condition: selection_parent and selection_fw_tool and selection_disable_args
falsepositives:
- Scheduled firmware maintenance scripts that legitimately reset firewall rules during
  config apply
- Administrator-initiated firewall reconfiguration through the legitimate management
  UI
level: high
tags:
- attack.t1562.004
- attack.defense_evasion
id: b2bb580f-8753-5d38-89b8-a6902f6ebdc1
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2024/20250122-jvn.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free