PT-2025-43014 · Unknown · Mercku M6A

Published 2025-10-22 · Updated 2025-10-22 · CVE-2025-62771

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mercku M6a versions through 2.1.0

Description Mercku M6a devices versions through 2.1.0 are susceptible to password changes through intranet Cross-Site Request Forgery (CSRF) attacks. CSRF attacks involve malicious websites or emails tricking a user's browser into performing unwanted actions on a trusted site. In this case, an attacker could potentially change the password of the Mercku M6a device without the user's knowledge or consent, provided the attacker can induce the user to perform a specific action while logged into the device's intranet interface.

Recommendations Update Mercku M6a devices to a version later than 2.1.0.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-62771

Affected Products

Mercku M6A

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-62771 · Security Note
• https://seclists.org/fulldisclosure/2025/Oct/10 · Note
• https://blog.nullvoid.me/posts/mercku-exploits · Note
• https://t.me/cveNotify/139802 · Telegram Post
• https://t.me/CVEtracker/35449 · Telegram Post
• https://twitter.com/CVEnew/status/1980842237194866920 · Twitter Post