CVE-2025-63217

critical · 9.8

The Itel DAB MUX (IDMUX build c041640a) is vulnerable to Authentication Bypass due to improper JWT validation across devices. Attackers can reuse a valid JWT token obtained from one device to authenticate and gain administrative access to any other device running the same firmware, even if the passwords and networks are different. This allows full compromise of affected devices.

9.8

CVSS

0.6%

EPSS (exploit prob.)

45th

EPSS percentile

2025-11-18

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-288

Affected products

Vendor	Product	Affected versions
itel	id_mux_firmware	all versions
itel	id_mux	all versions

Check a specific version with /api/v1/cve/match.

References

https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63217%20_%20Itel%20DAB%20MUX%20Authentication%20Bypass
https://www.itel.it/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-63217