PT-2025-23437 · Unknown · Mist Community Edition

Alex Perrakis + 3 · Published 2025-06-01 · Updated 2025-11-25 · CVE-2025-5410

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mist Community Edition versions up to 4.7.1

Description A vulnerability was found in the function session start response of the file src/mist/api/auth/middleware.py. This issue leads to cross-site request forgery and can be initiated remotely.

Recommendations For Mist Community Edition versions up to 4.7.1, upgrade to version 4.7.2 to address this issue.

Exploit

Fix

Missing Authorization

CSRF

Weakness Enumeration

CWE-862

CWE-352

Related Identifiers

CVE-2025-5410

Affected Products

Mist Community Edition

References · 14

• 🔥 https://github.com/Stolichnayer/mist-ce-csrf · Exploit
• https://github.com/mistio/mist-ce/releases/tag/v4.7.2 · Patch
• https://github.com/mistio/mist.api/commit/db10ecb62ac832c1ed4924556d167efb9bc07fad · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-5410 · Security Note
• https://osv.dev/vulnerability/CVE-2025-5410 · Vendor Advisory
• https://t.me/cvenotify/124280 · Telegram Post
• https://clamvn.com/cve/CVE-2025-5410 · Reddit Post
• https://vuldb.com/?id.310750 · Note
• https://t.me/cvetracker/25112 · Telegram Post
• https://t.me/cveNotify/143932 · Telegram Post
• https://vuldb.com/?submit.583532 · Note
• https://vuldb.com/?ctiid.310750 · Note
• https://twitter.com/VulmonFeeds/status/1929350844723392880 · Twitter Post
• https://twitter.com/CVEnew/status/1929309774799081924 · Twitter Post