Security researcher Semaja2 has disclosed a Remote Code Execution and Arbitrary File Upload vulnerability in Siklu EtherHaul Series devices running firmware 7.4.0 – 10.7.3. These allow attackers to execute code without authentication on the devices, which can lead to full control being obtained. These were discovered during his audit of previous vulnerabilities to see if the company had fixed past disclosures in an efficient manner.

As of the vulnerability release there it no patch to fix the issues.

Downloads

CVE-2025-57174 - EH-8010 / EH-1200 Remote Command Execution Exploit

CVE-2025-57176 - EH-8010 / EH-1200 Arbitrary File Upload Exploit