CVE-2025-22940

The vulnerability lies in improper access control (CWE-284) in the Adtran 411 ONT device firmware. The mechanism responsible for changing the administrator password does not verify the identity or permissions of the requester, allowing any attacker with network access to the device to trigger this operation. An attacker can remotely, without authentication and without user interaction, overwrite the administrator password with their own value.

Attacker gains full administrative control over the Adtran 411 ONT device, leading to loss of confidentiality and integrity of configuration and data. Legitimate administrators may be permanently locked out from managing the device.

Apply patches available from the manufacturer according to references. Until the fix is implemented, it is recommended to restrict network access to the device management interface exclusively to trusted IP addresses using firewall or ACL rules.

Adtran 411 ONT with firmware version L80.00.0011.M2