CVE-2023-32645: Yifan YF325 httpd debug credentials authentication bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication and no user interaction, plus a very high EPSS score, makes this an urgent exposure for any internet-facing YF325.

What it is

The Yifan YF325 firmware (v1.0_20221108) ships leftover debug credentials in the httpd component. A specially crafted network request can exploit this debug functionality to bypass authentication entirely. Because the device is a network-facing router, an unauthenticated bypass exposes full administrative control.

Impact

An attacker gains unauthenticated access to the device's web management interface, with high impact to confidentiality, integrity and availability per the CVSS vector. This effectively hands over administrative control of the router.

Attack surface

Reachable over the network via HTTP to the httpd service; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required. The debug credentials functionality is the specific entry point.

Exploitation

Not listed in CISA KEV and no ransomware usage documented, but EPSS is 0.538 (98.9th percentile), indicating a high likelihood of exploitation activity. References are third-party advisories only, with no public exploit tag supplied.

What to do

• Apply the vendor firmware update for YF325 if one is available; check Yifan advisories directly since the record does not name a fixed version.
• If no patch exists, disable or block remote access to the httpd management interface and restrict it to a trusted management VLAN.
• Remove or disable the debug credentials functionality if the firmware allows it; treat leftover debug code as a defect to be eliminated.
• Place the device behind a firewall and do not expose its web interface to the internet.
• Replace end-of-life or unpatched YF325 units with supported hardware if the vendor provides no fix.

Detection

• Monitor HTTP requests to the YF325 management interface for unusual paths or parameters associated with debug endpoints.
• Alert on successful authentication or administrative actions from unexpected source IPs or without a preceding login.
• Baseline normal management traffic and flag anomalous request patterns to the httpd service.
• Review device logs for configuration changes or reboots that were not initiated by known administrators.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.