CVE-2025-56015: 
JavaScript vulnerability analysis and mitigation

CVE-2025-56015 is an unauthenticated access vulnerability in the NBI (Northbound Interface) API endpoint of GenieACS, a TR-069 Auto Configuration Server. It affects GenieACS version 1.2.13 and was published on April 7, 2026. The vulnerability allows remote, unauthenticated attackers to access sensitive data exposed by the NBI REST API, and when chained with a JavaScript sandbox escape flaw, can lead to full remote code execution (RCE). It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Feedly).

The root cause is improper access control (CWE-284) on the GenieACS NBI API, which listens on port 7557 by default and does not enforce authentication for sensitive endpoints. Unauthenticated HTTP requests can retrieve user password hashes and salts (/users/), file listings (/files/), and provisioning scripts (/provisions/). A second, related vulnerability involves a JavaScript sandbox escape: the provisioning script execution environment fails to prevent prototype chain traversal via declare.constructor.constructor, allowing attackers to access Node.js's child_process and net modules and execute arbitrary OS commands. The combined attack chain — unauthenticated NBI access to create provisions/presets, followed by CWMP device simulation to trigger execution — achieves pre-authentication RCE (PoC Repository, Github Advisory).

An unauthenticated network attacker can read sensitive data from the GenieACS NBI API, including user credential hashes and salts, provisioning configurations, and file listings, leading to a high confidentiality impact. When chained with the sandbox escape, the attacker achieves full remote code execution on the server as the GenieACS service account, enabling reverse shell access, network pivoting, and complete server compromise. Integrity and availability are not directly impacted by the base vulnerability alone, but the RCE chain effectively nullifies all three security properties (PoC Repository, Feedly).

A public proof-of-concept exploit (exploit.py) is available on GitHub, developed by the Datafarm Co., Ltd. DF Pentest Team (Thailand), which automates the full attack chain including provision creation, preset configuration, CWMP device simulation, and reverse shell delivery (PoC Repository). No evidence of in-the-wild exploitation has been reported as of the time of writing, and no threat actor attribution is available. The EPSS score is approximately 0.058% (18th percentile), indicating a currently low but non-negligible exploitation probability. The vulnerability is not listed in the CISA KEV catalog (Github Advisory, Feedly).

1. Reconnaissance: Identify internet-facing GenieACS instances running version 1.2.13 using Shodan or Censys, targeting port 7557 (NBI API) and port 7547 (CWMP interface).
2. Data exfiltration via unauthenticated NBI access: Send unauthenticated HTTP GET requests to sensitive endpoints to harvest credentials and configuration data:

   curl 'http://<target>:7557/users/'
   curl 'http://<target>:7557/provisions/'
   curl 'http://<target>:7557/files/'

3. Create malicious provision: Use the NBI API to create a provision script containing a JavaScript sandbox escape payload via the declare.constructor.constructor prototype chain to access Node.js child_process and execute a reverse shell:

   curl -X PUT 'http://<target>:7557/provisions/<provision_name>' -d '<malicious_js_payload>'

4. Create a preset: Link the malicious provision to a CWMP event (e.g., "2 PERIODIC") via an unauthenticated PUT request to /presets/<preset_name> on the NBI API.
5. Simulate a CWMP device: Send a crafted TR-069 Device Inform SOAP message to the CWMP interface (port 7547) to register a fake CPE device and trigger the Periodic event.
6. Trigger payload execution: Subsequent Periodic Inform requests from the simulated device cause GenieACS to execute the malicious provision script, spawning a reverse shell to the attacker's listener (nc -lvnp <LPORT>).
7. Achieve RCE: The attacker receives a reverse shell with the privileges of the GenieACS service account, enabling full server compromise and lateral movement (PoC Repository).

• Network: Unauthenticated HTTP GET requests to http://<host>:7557/users/, /provisions/, or /files/ from external or unexpected IP addresses; unauthenticated PUT requests to /provisions/ or /presets/ on port 7557; unexpected CWMP Inform SOAP messages on port 7547 from unknown device identifiers; outbound connections from the GenieACS server to unknown external IPs on non-standard ports (e.g., attacker's reverse shell listener).
• Logs: GenieACS NBI access logs showing unauthenticated API calls to sensitive endpoints; creation of new provision or preset entries not initiated by administrators; CWMP logs showing Inform messages from unrecognized or simulated device serial numbers.
• File System: Unexpected or newly created provision scripts in the GenieACS database containing constructor.constructor patterns or references to child_process or net Node.js modules.
• Process: Unusual child processes spawned by the GenieACS Node.js process (e.g., /bin/sh, bash, nc, curl, wget) indicating sandbox escape and command execution (PoC Repository).

The GitHub Advisory notes that no patched version is explicitly listed for the = 1.2.13 affected range, but the GenieACS repository has releases up to v1.2.16 which may address the issue; users should upgrade to the latest available version beyond 1.2.13 (Github Advisory, GenieACS Repo). As an immediate workaround, restrict network access to the NBI API port (7557) using firewall rules so that only authorized management systems can reach it — it should never be exposed to the public internet. Additionally, restrict access to the CWMP port (7547) to known CPE device IP ranges, and implement authentication at the API gateway or reverse proxy level in front of the NBI service.

The vulnerability was credited to researchers Thanasin Luangpipat, Natchanon Jaengsuwan, Navapon Premkasem, and Suebpong Sittichotpong from Datafarm Co., Ltd.'s DF Pentest Team in Thailand, who also developed the public PoC exploit (PoC Repository). Red Hat published a CVE tracking page for the vulnerability, indicating broader industry awareness (Red Hat CVE). No significant vendor statements from GenieACS or widespread media coverage have been identified beyond the GitHub advisory and vulnerability database entries.