Güralp Systems FMUS Series - Unauthenticated Access

criticalseverity

9.8CVSS score

1.4%likelihood of exploitation, next 30 days

72%of all CVEs are less likely

Readycheck to confirm it

Güralp Systems FMUS Series Seismic Monitoring Devices expose an unauthenticated Telnet-based command line interface that allows attackers to modify hardware configurations, manipulate data, or factory reset the device.

Impact

Successful exploitation of this vulnerability could allow an attacker to modify hardware configurations, manipulate data, or factory reset the device.

Fix

Update to the latest firmware version or apply vendor recommended patches to secure Telnet access.

How to confirm it

Send: tcp probe to {{Hostname}}
Positive when: contains in banner "Welcome to" and "type \"help\" for a list of available commands" AND contains in system_info "Host Name:" and "Firmware Version:"

Run it with nuclei: nuclei -id CVE-2025-8286 -u <target>

The full check

id: CVE-2025-8286

info:
  name: Güralp Systems FMUS Series - Unauthenticated Access
  severity: critical
  author: darses
  description: |
    Güralp Systems FMUS Series Seismic Monitoring Devices expose an unauthenticated Telnet-based command line interface that allows attackers to modify hardware configurations, manipulate data, or factory reset the device.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to modify hardware configurations, manipulate data, or factory reset the device.
  reference:
    - https://www.cisa.gov/news-events/ics-advisories/icsa-25-212-01
    - https://www.cve.org/CVERecord?id=CVE-2025-8286
  remediation: |
    Update to the latest firmware version or apply vendor recommended patches to secure Telnet access.
  classification:
    cwe-id: CWE-306
    cve-id: CVE-2025-8286
    epss-score: 0.0137
    epss-percentile: 0.72157
    cvss-metrics: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    cvss-score: 9.8
  metadata:
    verified: true
    vendor: guralp_systems
    product: fmus_series_seismic_monitoring_devices
    shodan-query: '"Welcome to " "list of available commands" port:4244'
    fofa-query: '"Welcome to " && "list of available commands" && port="4244"'
  tags: cve,cve2025,tcp,network,telnet,guralp,ics,vuln

tcp:
  - host:
      - "{{Hostname}}"

    port: 4244

    inputs:
      - data: "\n"
        read: 256
        name: banner

      - data: "system info\n"
        read: 256
        name: system_info

    matchers-condition: and
    matchers:
      - type: word
        part: banner
        words:
          - "Welcome to "
          - 'type "help" for a list of available commands'
        condition: and

      - type: word
        part: system_info
        words:
          - "Host Name: "
          - "Firmware Version: "
        condition: and

    extractors:
      - type: regex
        part: system_info
        group: 1
        regex:
          - "Host\\s+Name:\\s+([\\w\\d\\.\\-]+)"

      - type: regex
        part: system_info
        group: 1
        regex:
          - "Firmware\\s+Version:\\s+([\\d\\.\\-]+)"

References

Use this check only on systems you are authorised to test. Where the data comes from