PT-2025-43014 · Unknown · Mercku M6A

Publicado 2025-10-22 · Atualizado 2025-10-22 · CVE-2025-62771

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mercku M6a versions through 2.1.0

Description Mercku M6a devices versions through 2.1.0 are susceptible to password changes through intranet Cross-Site Request Forgery (CSRF) attacks. CSRF attacks involve malicious websites or emails tricking a user's browser into performing unwanted actions on a trusted site. In this case, an attacker could potentially change the password of the Mercku M6a device without the user's knowledge or consent, provided the attacker can induce the user to perform a specific action while logged into the device's intranet interface.

Recommendations Update Mercku M6a devices to a version later than 2.1.0.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2025-62771

Produtos afetados

Mercku M6A

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-62771 · Nota de Segurança
• https://seclists.org/fulldisclosure/2025/Oct/10 · Nota
• https://blog.nullvoid.me/posts/mercku-exploits · Nota
• https://t.me/cveNotify/139802 · Publicação no Telegram
• https://t.me/CVEtracker/35449 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1980842237194866920 · Publicação no Twitter