CVE-2018-25134
Authentication Bypass in Synaccess netBooter Allows Admin Account Creation
Publication date: 2025-12-24
Last updated on: 2025-12-24
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| synaccess | netbooter | 4.0 |
| synaccess | netbooter | 5.53 |
| synaccess | netbooter | 6.5 |
| synaccess | netbooter | 6.8 |
| synaccess | netbooter | 6.8C |
| synaccess | netbooter | 6.10 |
| synaccess | netbooter | 6.4A |
| synaccess | netbooter | 6.4 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
This vulnerability exists in Synaccess netBooter NP-02x and NP-08x series devices running version 6.8 or earlier. It is an authentication bypass flaw in the webNewAcct.cgi script used for user creation. Due to a missing control check, an unauthenticated attacker can send specially crafted POST requests to create an administrative user account without needing to authenticate. This allows the attacker to gain unauthorized administrative access to the device. [1, 2]
How can this vulnerability impact me? :
Exploiting this vulnerability allows an attacker to bypass authentication and gain full administrative control over the affected netBooter devices. This includes the ability to remotely power off connected devices managed by the netBooter units, potentially disrupting power supply management and causing operational outages or damage to connected equipment. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to exploit the authentication bypass in the webNewAcct.cgi script. A proof-of-concept exploit uses a crafted POST request to create an administrative user account without authentication. For example, a curl command can be used to send such a POST request to the vulnerable device's webNewAcct.cgi endpoint to check if unauthorized account creation is possible. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting network access to the vulnerable netBooter devices to trusted administrators only, disabling remote management if possible, and monitoring for unauthorized administrative accounts. Since the vendor did not respond to the vulnerability report, applying any available firmware updates or patches from Synaccess Networks Inc. should be prioritized once available. Additionally, consider isolating the devices from untrusted networks to prevent exploitation. [2]