PT-2025-23437 · Unknown · Mist Community Edition

Alex Perrakis + 3 · CVE-2025-5410 · Published 2025-06-01 · Updated 2025-11-25

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mist Community Edition versions up to 4.7.1

Description A vulnerability was found in the function session start response of the file src/mist/api/auth/middleware.py. This issue leads to cross-site request forgery and can be initiated remotely.

Recommendations For Mist Community Edition versions up to 4.7.1, upgrade to version 4.7.2 to address this issue.

Exploit

Fix

CSRF

Missing Authorization

Weakness Enumeration

CWE-352

CWE-862

Related Identifiers

CVE-2025-5410

Affected Products

Mist Community Edition

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5410.json · Exploit
• 🔥 https://github.com/Stolichnayer/mist-ce-csrf · Exploit
• https://github.com/mistio/mist-ce/releases/tag/v4.7.2 · Patch
• https://github.com/mistio/mist.api/commit/db10ecb62ac832c1ed4924556d167efb9bc07fad · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-5410 · Security Note
• https://osv.dev/vulnerability/CVE-2025-5410 · Vendor Advisory
• https://twitter.com/CVEnew/status/1929309774799081924 · Twitter Post
• https://t.me/cveNotify/143932 · Telegram Post
• https://t.me/cvenotify/124280 · Telegram Post
• https://t.me/cvetracker/25112 · Telegram Post
• https://vuldb.com/?id.310750 · Note
• https://vuldb.com/?ctiid.310750 · Note
• https://twitter.com/VulmonFeeds/status/1929350844723392880 · Twitter Post
• https://vuldb.com/?submit.583532 · Note
• https://clamvn.com/cve/CVE-2025-5410 · Reddit Post