CVE-2025-58272
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-03

Last updated on: 2025-09-04

Assigner: JPCERT/CC

Description
Cross-site request forgery vulnerability exists in Web Caster V130 versions 1.08 and earlier. If a logged-in user views a malicious page created by an attacker, the settings of the product may be unintentionally changed.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-03
Last Modified
2025-09-04
Generated
2026-06-16
AI Q&A
2025-09-03
EPSS Evaluated
2026-06-15
NVD
CVE-2025-58272
EUVD
EUVD-2025-26635
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
ntt west web_caster_v130
ntt east web_caster_v130
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the Web Caster V130 broadband router firmware version 1.08 and earlier. If a logged-in user visits a malicious webpage created by an attacker, the attacker can cause the router's settings to be changed without the user's consent. [1, 2, 3]

Impact Analysis

If you are logged into the Web Caster V130 router's web configuration interface and visit a malicious webpage, an attacker can change your router's settings without your knowledge or consent. This could disrupt your network configuration or affect device functionality. [1, 2, 3]

Detection Guidance

You can detect this vulnerability by checking the firmware version of your Web Caster V130 router. Access the router's web interface at http://192.168.100.1/, log in with the username "user" and your configured password, and verify the firmware version displayed at the top left of the settings screen. If the firmware version is 1.08 or earlier, the device is vulnerable. There are no specific network commands provided to detect the vulnerability directly. [1, 2]

Mitigation Strategies

To mitigate this vulnerability, immediately update the firmware of your Web Caster V130 router to version 1.09 or later. If your device is set to automatic firmware updates, the patch should be applied automatically. If you use manual updates, download and install the latest firmware from the official NTT West or NTT East websites. Additionally, avoid visiting untrusted or malicious web pages while logged into the router's web interface. [1, 2, 3]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-58272. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart