HITRON

A critical vulnerability (CVE-2025-44179) in HITRON's smart bus systems allows attackers to exploit hard-coded credentials and unauthenticated access points like Telnet, SSH, and MQTT. This flaw enables real-time tracking of bus locations and remote control of critical subsystems, including door operations, engine functions, and HVAC settings. Attackers can escalate privileges, execute arbitrary code, and potentially disrupt passenger safety and fleet operations. The vulnerability stems from embedded backdoors and unencrypted telemetry, posing significant risks to urban transit networks.

Source: https://cybersecuritynews.com/smart-bus-systems-vulnerability/

TPRM report: https://www.rankiteo.com/company/hitron-technologies

"id": "hit211081225",
"linkid": "hitron-technologies",
"type": "Vulnerability",
"date": "8/2025",
"severity": "100",
"impact": "7",
"explanation": "Attack that could injure or kill people"

{'affected_entities': [{'industry': 'Public Transportation',
                        'type': 'Transit Providers'}],
 'attack_vector': ['Unauthenticated API/SSH/Telnet access',
                   'Hard-coded credentials',
                   'MQTT credentials leak'],
 'data_breach': {'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Real-time GPS data',
                                              'Operational data']},
 'description': 'A newly discovered security flaw in leading smart bus systems '
                'threatens to expose passenger safety and fleet integrity. '
                'Researchers have identified a critical vulnerability '
                'CVE-2025-44179 in the remote management interface of several '
                'major transit providers’ onboard modems. Exploiting this '
                'weakness, attackers can both track the real-time location of '
                'buses and issue remote control commands to critical '
                'subsystems such as door operations, engine start/stop, and '
                'HVAC settings.',
 'impact': {'brand_reputation_impact': 'Potential loss of passenger trust',
            'data_compromised': ['Real-time GPS data', 'Operational data'],
            'operational_impact': 'Disruption of urban transit networks',
            'systems_affected': ['Onboard modems',
                                 'CAN bus interface',
                                 'Door actuators',
                                 'Brakes',
                                 'HVAC settings']},
 'initial_access_broker': {'backdoors_established': 'Hard-coded credentials in '
                                                    'firmware',
                           'entry_point': ['Telnet/SSH backdoors',
                                           'MQTT credentials'],
                           'high_value_targets': ['Real-time GPS data',
                                                  'CAN bus interface']},
 'lessons_learned': 'Ensuring the security of connected infrastructure is '
                    'paramount in public transport.',
 'post_incident_analysis': {'corrective_actions': ['Disable Telnet/SSH '
                                                   'services',
                                                   'Enforce unique per-device '
                                                   'credentials',
                                                   'Deploy firmware updates',
                                                   'Migrate MQTT streams to '
                                                   'mutually authenticated '
                                                   'TLS'],
                            'root_causes': ['Hard-coded credentials',
                                            'Unauthenticated API access',
                                            'Lack of input validation']},
 'recommendations': ['Disable insecure services',
                     'Enforce unique per-device credentials',
                     'Deploy firmware updates',
                     'Migrate MQTT streams to mutually authenticated TLS',
                     'Rigorous input validation on all XGI endpoints'],
 'references': [{'source': 'Research by Chiao-Lin Yu'}],
 'response': {'containment_measures': ['Disable Telnet/SSH services',
                                       'Enforce unique per-device credentials'],
              'remediation_measures': ['Deploy firmware updates',
                                       'Migrate MQTT streams to mutually '
                                       'authenticated TLS']},
 'title': 'Critical Vulnerability in Smart Bus Systems (CVE-2025-44179)',
 'type': 'Vulnerability Exploitation',
 'vulnerability_exploited': 'CVE-2025-44179'}