Detecting Or Hunting For CVE-2025-0108

ameermane — Tue, 04 Mar 2025 04:52:17 GMT

Hello Folks,

I am looking for a ways to detect the attempt for this vulnerability through SIEM. Based on the blogs available the vulnerability can be exploited by accessing URL with "unauth" on management interface. So I am thinking to look for web interface access logs with keyword "unauth". However, I would like your help to get below details.

1. Which log will provide management IP address?

2. Whenever a user accesses the management IP through web, which type of logs will provides access log? (traffic, config, system etc.)

3. Which type of log will give full URL when user access web interface.

Feel free to guide my any resource that provide this information.

Thanks in advance.

Regards,

Ameer Mane

Re: Detecting Or Hunting For CVE-2025-0108

JayGolf — Thu, 06 Mar 2025 03:55:00 GMT

Hi @ameermane ,

You can check the system logs and query for ( eventid eq 'auth-fail' ) or for all logs related to auth ( subtype eq 'auth' )

topic Detecting Or Hunting For CVE-2025-0108 in General Topics

Detecting Or Hunting For CVE-2025-0108

Re: Detecting Or Hunting For CVE-2025-0108