Response header injection via unsanitized request path
Published Jan 24, 2025 · Updated Feb 12, 2025
HTTP response header injection in Telstra Smart Modem Gen 2 version 20250115 allows remote attackers to alter server responses. The HTTP header handler copies the URL path after /robots.txt into Content-Disposition without neutralizing percent-encoded CRLF sequences. No authentication is required, and a crafted GET permits arbitrary response headers or an attacker-controlled response body; published impact is limited to response integrity.
Summary
What happened
HTTP response header injection in Telstra Smart Modem Gen 2 version 20250115 allows remote attackers to alter server responses. The HTTP header handler copies the URL path after /robots.txt into Content-Disposition without neutralizing percent-encoded CRLF sequences. No authentication is required, and a crafted GET permits arbitrary response headers or an attacker-controlled response body; published impact is limited to response integrity.
The record
- CVE
- CVE-2025-0697
- Published
- Jan 24, 2025
- Updated
- Feb 12, 2025
- Vendor
- Telstra
- Product
- Telstra Smart Modem Gen 2
- Classifications
- CWE-74, CWE-707, T1190
- Attack vector
- network
- Privileges
- unauthenticated
Timeline
How it unfolded
- Jan 24, 2025CVE publishedPublication date reported by the CVE source.
- Feb 12, 2025Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=20250115
What conditions does exploitation require?
What is affected?
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Weakness, pattern, technique
Public exploit references
- Telstra-RHI CRLF response-header injection demonstrationproof of concept · demonstrated
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo