CVE-2025-45422: Proximus b-box v8c.725A Access Control Flaw Allows Unauthorized Port Forwarding Changes

Technical summary

CVE-2025-45422 stems from improper access control (CWE-284) in the Proximus b-box v8c.725A firmware. The port forwarding configuration interface fails to properly validate whether an authenticated user should be permitted to modify specific forwarding rules. An attacker with valid login credentials can send requests to alter port mappings, bypassing the intended authorization checks. The vulnerability does not require user interaction and operates at the network layer, making it a direct integrity issue once authentication is obtained.

Business impact

An attacker exploiting this flaw could redirect inbound traffic on critical ports to attacker-controlled systems, effectively man-in-the-middle internet-facing services. For residential and small-business customers, this could expose email servers, remote access systems, or internal web applications to interception or hijacking. The impact scales with the sensitivity of services typically exposed through port forwarding—VPN gateways, file servers, and management consoles are high-value targets.

Affected systems

Proximus b-box v8c.725A is the confirmed affected device. This is a consumer/SMB router typically supplied by Proximus (Belgium's incumbent telecom). The vulnerability applies only to this specific firmware version; customers running different versions or models should verify their own exposure separately, as the vendor product list was not provided in this advisory.

Exploitability

Exploitation requires valid authentication credentials (PR:L in the CVSS vector), making this a post-compromise risk rather than a wormable flaw. An attacker must first obtain legitimate access—via credential theft, physical access, default credentials, or insider knowledge. Once authenticated, no additional conditions are required; the attack is network-accessible and does not need user interaction. The low attack complexity means a standard web interface or API call suffices.

Remediation

Proximus should issue a firmware patch that implements proper authorization controls on port forwarding modifications, ensuring users can only alter rules within their assigned scope. Customers should upgrade their b-box to a patched firmware version once available. Verify the patch version against Proximus's official security advisory before deployment. Until patching is feasible, network segmentation and strong credential hygiene are essential mitigations.

Patch guidance

Monitor Proximus's official support and security channels for firmware updates addressing CVE-2025-45422. When a patch is released, apply it at your earliest maintenance window. Proximus typically provides firmware updates via the router's web interface or automatic update feature; verify the update path and check release notes to confirm the fix. For organizations managing multiple b-box devices, test the patch in a non-production environment first to rule out compatibility issues.

Detection guidance

Examine audit logs and configuration change history on affected b-box devices for unexpected modifications to port forwarding rules, particularly from admin or service accounts. Monitor network traffic for unusual port redirection or services appearing on unexpected ports. If your b-box supports detailed logging, enable it and look for API calls or interface submissions to the port forwarding configuration endpoints from unexpected source IPs or at unusual times. Behavioral analysis of inbound traffic—watching for redirects to new destinations—may also reveal exploitation in progress.

Why prioritize this

This vulnerability scores 8.1 (HIGH) due to its direct impact on confidentiality and integrity (C:H, I:H), network accessibility, and low attack complexity. However, the requirement for prior authentication limits its urgency compared to unauthenticated remote code execution flaws. Prioritize patching if your organization operates Proximus b-box routers in internet-facing roles or manages them in multi-tenant environments where insider threat is a concern. It is not currently listed on CISA's Known Exploited Vulnerabilities catalog.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects: Network-accessible attack vector (AV:N), low complexity (AC:L), and low privileges required (PR:L) earn high base points. The high impact on confidentiality and integrity (C:H, I:H)—allowing attackers to intercept or redirect traffic—further elevates severity. The unchanged availability (A:N) prevents a critical rating. The score assumes an attacker already holds valid credentials; organizations with strong access controls and credential management benefit from reduced practical risk.

Frequently asked questions