CVE-2018-25151

MEDIUM

Ecessa WANWorx WVR-30 <10.7.4 - CSRF

Title source: llm

Description

Ecessa WANWorx WVR-30 versions before 10.7.4 contain a cross-site request forgery vulnerability that allows attackers to perform administrative actions without request validation. Attackers can craft a malicious web page with a hidden form to create a new superuser account by tricking an authenticated administrator into loading the page.

Exploits (1)

exploitdb WORKING POC
by LiquidWorm · textwebappshardware
https://www.exploit-db.com/exploits/44936

References (2)

Scores

CVSS v3 4.3
EPSS 0.0002
EPSS Percentile 5.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Classification

CWE
CWE-352
Status draft

Timeline

Published Dec 24, 2025
Tracked Since Feb 18, 2026