CVE-2025-45583 is a critical access control flaw (CVSS 9.1) in the FTP service of the Audi UTR 2.0 Universal Traffic Recorder. The record says the service lets a client authenticate with any username and password. No fix is listed, so keep the device off untrusted networks and ask the vendor how to proceed.
What's affected
The record names the Audi Universal Traffic Recorder 2.0 and its firmware. It describes incorrect access control in the FTP protocol, so that any combination of username and password is accepted.
The record points to a single public report and no vendor advisory. It names no fixed firmware, and it gives no version range beyond the product name. Treat every unit of this model as affected until the vendor says otherwise.
How to check if you're exposed
This is an embedded device, so there is no package to query. Use these checks:
- Find every unit of this model in your fleet or lab, including units you inherited with a vehicle or site.
- Check whether the FTP service (normally TCP port 21) is reachable on the device from your network or from the internet. Your network scanner or firewall logs will show this.
- Look at the FTP logs on the device, if it keeps any, for logins from unfamiliar addresses.
- Ask the supplier which firmware is current and whether the login check has been fixed.
What to do now
- Inventory all Audi UTR 2.0 units and note their network addresses.
- Block FTP to and from the device at the firewall unless you need it, and never expose it to the internet.
- Place the device on a separate network segment so that only the systems that must reach it can do so.
- Contact the supplier for a firmware update and for confirmation of the affected versions.
- Review the files stored on or served by the device, since an unauthenticated FTP client could read or change them.
- If the device cannot be fixed and must stay online, plan its replacement.
Why it matters
The record lists CWE-287 (Improper Authentication). The service fails the most basic test of authentication: it does not check the credentials it is given. Anyone who can reach the port is treated as a valid user.
The score is 9.1 because the vector (AV:N, AC:L, PR:N, UI:N) needs nothing from the attacker, and the impact on confidentiality and integrity is high. Availability is not rated. What an attacker could do depends on what the device exposes over FTP, which the record does not describe. The record does not mark this CVE as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
Quick check
Is there a patched firmware?
The record does not name one. Contact the supplier and keep the device off untrusted networks in the meantime.
Does a firewall rule solve it?
It reduces the risk a lot, because the flaw needs network access to the FTP port. It does not fix the login check, so the device still needs a vendor update.
Sources
Last reviewed: 18 October 2026.
