PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-1907 Instantel CVE debrief

CVE-2025-1907 is a critical authentication weakness in Instantel Micromate systems exposed through a modem-enabled remote access path. According to CISA’s advisory, an unauthorized attacker can access the configuration port and execute commands, which may allow device reconfiguration. The advisory also states the issue does not provide access to other network resources or escalation beyond the device itself. Instantel later updated the advisory to note that a patch is now available.

Vendor
Instantel
Product
Micromate
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-05-29
Original CVE updated
2025-08-07
Advisory published
2025-05-29
Advisory updated
2025-08-07

Who should care

Site operators, OT/industrial control system administrators, and support teams responsible for Instantel Micromate deployments—especially any device connected to a modem that enables remote access—should review this immediately.

Technical summary

The advisory describes a lack of proper authentication on a Micromate configuration port when the device is connected to a modem that enables remote access. The affected product listing identifies Instantel Micromate versions below 11.0BD_and_11.0CB. CISA’s description says an attacker can gain access and execute commands, potentially reconfiguring the device. The published impact is limited to the device itself; the advisory says it does not allow access to other network resources or escalation beyond the device. The CVSS 3.1 vector provided is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, corresponding to a 9.8 Critical score.

Defensive priority

Critical for any exposed Micromate deployment. Prioritize rapid verification of exposure, patching to the vendor-fixed version, and restriction of modem/remote access paths until remediation is complete.

Recommended defensive actions

  • Install the vendor update released by Instantel for Micromate as soon as possible.
  • Confirm whether any Micromate unit is connected to a modem that enables remote access.
  • Restrict modem access to approved IP addresses only, as recommended in the advisory.
  • Review configuration and operational access paths for any unnecessary remote exposure.
  • Coordinate with Instantel technical support if you need help confirming the correct update or remediation path.
  • Monitor Micromate configuration changes for unauthorized or unexpected activity until the fix is deployed and validated.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-25-148-04 (Instantel Micromate, Update A) and the embedded source metadata. The advisory was initially published on 2025-05-29 and updated on 2025-08-07 to include the available patch and revised affected versions/language. The affected product entry names Instantel Micromate: <11.0BD_and_11.0CB. The advisory states that the issue only affects the device itself and does not provide access to other network resources or escalation beyond the device.

Official resources

Publicly disclosed by CISA on 2025-05-29 and updated on 2025-08-07; the later update notes the patch is now available.