PT-2025-51103
CVE-2025-36754
·
Published
2025-12-13
·
Updated
2025-12-13
Description by
CVSS 4.0
9.3
CriticalMetricsAV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
versions prior to 2025 (affected versions not specified)
Description
The authentication mechanism on the web interface is flawed, allowing bypass of authentication checks through crafted POST requests with new settings. This is due to the absence of session tokens or authentication measures. An attacker could redirect the device to an arbitrary address for domain name resolution, potentially enabling a man-in-the-middle (MitM) attack. The vulnerability involves crafting a POST request to manipulate settings without proper authentication.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾