CVE-2019-25254
HIGHKYOCERA Net Admin 3.4.0906 - Cross-Site Request Forgery via Administrative User Creation
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2019-25254. PoCs published by LiquidWorm.
AI-analyzed exploit summary This exploit demonstrates a CSRF vulnerability in KYOCERA Net Admin 3.4.0906, allowing an attacker to add an administrator account via a malicious webpage. The PoC submits a crafted form to the target application without requiring user interaction beyond visiting the page.
Description
KYOCERA Net Admin 3.4.0906 contains a cross-site request forgery vulnerability that allows attackers to create administrative users without proper request validation. Attackers can craft malicious web pages that automatically submit forms to add new admin accounts with predefined credentials when a logged-in user visits the page.
Exploits (1)
This exploit demonstrates a CSRF vulnerability in KYOCERA Net Admin 3.4.0906, allowing an attacker to add an administrator account via a malicious webpage. The PoC submits a crafted form to the target application without requiring user interaction beyond visiting the page.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H