CVE-2025-63729

Critical

Published: 25/11/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

In Syrotech SY-GPON-1110-WDONT (firmware SYRO_3.7L_3.1.02-240517), attackers can extract the SSL private key, CA certificate, SSL certificate, and client certificates in .pem format from the etc folder in the firmware.

Risk Assessment

Exposure of private keys and certificates allows attackers to impersonate the device, intercept encrypted traffic, and compromise communication integrity.

Recommendation

Immediately rotate all keys and certificates and update firmware to a version that does not expose these data.

Original NVD description (English source)

An issue was discovered in Syrotech SY-GPON-1110-WDONT SYRO_3.7L_3.1.02-240517 allowing attackers to exctract the SSL Private Key, CA Certificate, SSL Certificate, and Client Certificates in .pem format in firmware in etc folder.