CVE-2025-56009

MEDIUM

KeeneticOS < 4.3 - Cross-Site Request Forgery via RCI API Endpoint

Title source: llm
STIX 2.1

Description

Cross site request forgery (CSRF) vulnerability in KeeneticOS before 4.3 at "/rci" API endpoint allows attackers to take over the device via adding additional users with full permissions by managing the victim to open page with exploit.

References (3)

Core 3

Scores

CVSS v3 5.3
EPSS 0.0017
EPSS Percentile 6.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-352
Status published
Products (1)
keenetic/keeneticos < 4.3
Published Oct 23, 2025
Tracked Since Feb 18, 2026