Authentication Bypass Vulnerability in Newtec Celox UHD Devices

CVE-2025-63210

What is CVE-2025-63210?

The Newtec Celox UHD models CELOXA504 and CELOXA820, running firmware version celox-21.6.13, are susceptible to a significant vulnerability that allows an attacker to bypass authentication mechanisms. By intercepting responses from the /celoxservice endpoint and injecting a forged response during the login process, malicious actors can obtain elevated access rights, including Superuser or Operator status, without legitimate credentials. This flaw represents a critical security risk, enabling unauthorized control over the affected devices.

References