PT-2025-51103 · Unknown · Web Interface

Hamid Rahmouni + 1 · Published 2025-12-13 · Updated 2025-12-13 · CVE-2025-36754

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions versions prior to 2025 (affected versions not specified)

Description The authentication mechanism on the web interface is flawed, allowing bypass of authentication checks through crafted POST requests with new settings. This is due to the absence of session tokens or authentication measures. An attacker could redirect the device to an arbitrary address for domain name resolution, potentially enabling a man-in-the-middle (MitM) attack. The vulnerability involves crafting a POST request to manipulate settings without proper authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2025-36754

Affected Products

Web Interface

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-36754 · Security Note
• https://twitter.com/CVEnew/status/1999865326386000046 · Twitter Post
• https://csirt.divd.nl/CVE-2025-36754 · Note
• https://t.me/CVEtracker/39712 · Telegram Post