Cross site request forgery (CSRF) vulnerability in KeeneticOS before 4.3 at "/rci" API endpoint allows attackers to take over the device via adding additional users with full permissions by managing the victim to open page with exploit.
References
| Link | Resource |
|---|---|
| https://keenetic.com/ | Product |
| https://keenetic.com/global/security#october-2025-web-api-vulnerabilities | Vendor Advisory |
Configurations
History
04 Nov 2025, 13:09
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Keenetic
Keenetic keeneticos |
|
| References | () https://keenetic.com/ - Product | |
| References | () https://keenetic.com/global/security#october-2025-web-api-vulnerabilities - Vendor Advisory | |
| CPE | cpe:2.3:o:keenetic:keeneticos:*:*:*:*:*:*:*:* |
23 Oct 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| CWE | CWE-352 |
23 Oct 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-10-23 15:15
Updated : 2025-11-04 13:09
NVD link : CVE-2025-56009
Mitre link : CVE-2025-56009
CVE.ORG link : CVE-2025-56009
JSON object : View
Products Affected
keenetic
- keeneticos
CWE
CWE-352
Cross-Site Request Forgery (CSRF)