CISA warns of critical authentication bypass flaw in Raisecomm RAX701-GC Series
Take action: If you're using Raisecomm RAX701-GC devices make sure they are isolated from the internet and accessible only from trusted networks. Then reach out to the vendor for possible patches. Consider replacing these devices with supported alternatives if possible, since the manufacturer hasn't responded to fix this flaw.
Learn More
CISA is reporting a critical vulnerability in the Raisecomm RAX701-GC Series devices that allows attackers to establish SSH sessions and gain shell access without valid credentials.
The flaw is tracked as CVE-2025-11534 (CVSS score 9.3) and could enable attackers to gain unauthenticated root shell access to the devices, providing complete control over the systems.
Affected products:
- RAX701-GC-WP-01 P200R002C52: Firmware version 5.5.27_20190111
- RAX701-GC-WP-01 P200R002C53: Firmware version 5.5.13_20180720 and version 5.5.36_20190709
Raisecomm has not responded to CISA's requests to work on mitigating this vulnerability. As of October 21, 2025, no patches or firmware updates have been released to fix the flaw. of affected versions of Raisecomm products should contact Raisecomm customer support for additional information, though the lack of vendor response suggests support may be limited.
Organizations should ensure that all affected control system devices are not accessible from the internet and minimize network exposure wherever possible.
