CVE-2025-14266

LOW

Ercom Cryptobox 4.0.0-4.37.228 and 4.38.0-4.39.199 - Cross-Site Request Forgery in Administration Console

Title source: llm
STIX 2.1

Description

CSRF in Ercom Cryptobox administration console allows attacker to trigger some actions on behalf of a Cryptobox administrator. The attack requires the administrator to browse a malicious web site or to click a link while he has an open session on the administration console.

References (1)

Core 1
Core References

Scores

CVSS v4 0.6
EPSS 0.0016
EPSS Percentile 6.0%
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/AU:N/R:U

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-352
Status published
Products (2)
Ercom/Cryptobox 4.0.0 - 4.37.229
Ercom/Cryptobox 4.38.0 - 4.39.200
Published Dec 17, 2025
Tracked Since Feb 18, 2026