PT-2025-53353 · Synaccess · Netbooter Np-0801Du

Published 2025-12-24 · Updated 2025-12-24 · CVE-2018-25133

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Synaccess netBooter NP-0801DU version 7.4

Description The software contains a cross-site request forgery condition that may allow attackers to perform administrative actions without sufficient request validation. An attacker can create malicious web pages with hidden form submissions to add administrator users by deceiving authenticated administrators into loading a malicious page. The API endpoint used for adding admin users is susceptible to this issue. The vulnerable action involves tricking an authenticated administrator into performing an action, such as submitting a form, on a malicious website.

Recommendations Apply input validation to all administrative requests. Ensure proper request validation is implemented to prevent unauthorized actions.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2018-25133

Affected Products

Netbooter Np-0801Du

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-25133 · Security Note
• https://zeroscience.mk/en/vulnerabilities/ZSL-2018-5501.php · Note
• https://exploit-db.com/exploits/45894 · Note
• https://synaccess-net.com · Note
• https://t.me/cveNotify/146804 · Telegram Post