Vulnerability · Published Sep 25, 2025 · Assigned by CERT-In

CVE-2025-10957Unrestricted FTP Access Vulnerability in Syrotech Router

High 8.7

In plain English

A high-severity improper access control in Syrotech SY-GPON-2010-WADONT from Syrotech Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.3%top 73.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

This vulnerability exists in the Syrotech SY-GPON-2010-WADONT router due to improper access control in its FTP service. A remote attacker could exploit this vulnerability by establishing an FTP connection using default credentials, potentially gaining unauthorized access to configuration files, user credentials, or other sensitive information stored on the targeted device.

Affected products (as reported)

Vendor	Product	Versions
Syrotech Networks	Syrotech SY-GPON-2010-WADONT	V2.1.05-210329

Weakness: CWE-284 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0223 third-party-advisory