PT-2026-1439 · Njhyst · Njhyst Hy511 Poe Plugins+1

CVE-2025-65212 · Publicado 2026-01-06 · Atualizado 2026-01-06

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NJHYST HY511 POE core versions prior to 2.1 NJHYST HY511 POE plugins versions prior to 0.1

Description The device exhibits insufficient cookie verification, enabling an attacker to directly request the configuration file address and download the core configuration file without authenticating through the device management backend. Accessing the core configuration file allows an attacker to extract the username and a self-decrypted MD5 password, facilitating direct login to the backend and bypassing the standard login process.

Recommendations Versions prior to 2.1 of NJHYST HY511 POE core should be updated. Versions prior to 0.1 of NJHYST HY511 POE plugins should be updated.

Exploit

Correção

Enumeração de Fraquezas

CWE-565

Identificadores relacionados

CVE-2025-65212

Produtos afetados

Njhyst Hy511 Poe Core

Njhyst Hy511 Poe Plugins

Referências · 7

• 🔥 https://github.com/a2148001284/test1/blob/main/%E6%9C%AA%E6%8E%88%E6%9D%83%E8%AE%BF%E9%97%AE%E5%90%8E%E5%8F%B0%E6%BC%8F%E6%B4%9EEN.md · Exploit
• https://osv.dev/vulnerability/CVE-2025-65212 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-65212 · Nota de Segurança
• https://twitter.com/TheHackerWire/status/2008607607129600377 · Publicação no Twitter
• https://gist.github.com/a2148001284/bcdda75fc8718454f16a7b9259463719 · Nota
• https://twitter.com/TheHackerWire/status/2008607398957662250 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2008565820142874947 · Publicação no Twitter