CVE-2025-45422: Proximus b-box UPnP Persistence & Access Control Bypass

https://www.cve.org/CVERecord?id=CVE-2025-45422

This script demonstrates CVE-2025-45422 affecting Proximus b-box routers running firmware version 8c.725A. It leverages the router’s UPnP functionality to create arbitrary port forwarding rules for internal client IP addresses.

Due to insufficient access controls in the UPnP implementation, an attacker with access to the local network can create unauthorized port mappings. These mappings cannot be permanently removed through the router’s web interface and can only be disabled. An attacker can subsequently re-enable them at any time by issuing standard UPnP commands.

Additionally, UPnP cannot be fully disabled on the affected device, increasing the risk of unauthorized exposure of internal services and persistence of malicious port-forwarding configurations. By using the NewLeaseDuration parameter, an attacker may also create temporary port mappings that expire automatically, reducing the visibility of malicious activity.

UPnP defines AddPortMapping() and DeletePortMapping() actions for managing port mappings. When users are unable to remove port mappings through the management interface while UPnP clients remain able to create them, they lose an important security control over externally exposed services.

As a result, an attacker can create and re-enable port forwarding rules while the device owner lacks an equivalent mechanism through the GUI to permanently remove them.

The vulnerability was reproduced on two separate Proximus b-box 3 routers running firmware version 8c.725A.

In addition to demonstrating the vulnerability, this script provides functionality to enumerate and remove UPnP port mappings, allowing affected users to remove mappings that cannot be permanently deleted through the router’s web interface.

Note: This repository contains proof-of-concept research code intended to demonstrate the vulnerability. The PoC is not intended to be production-quality software and may contain implementation-specific assumptions or limitations.